Entitlement Is Not Authorization

Subscription software must answer one question on every request: may this user do this, now? Production systems usually treat the answer as authoritative state, read at request time, and assume that stronger consistency is always safer. We systematize what is publicly known about entitlement correct- ness when billing truth is owned externally, and ask whether the consistency- token protocols of internal authorization transfer to it. Method. A multivocal review of 85 sources, two propositions, an error-cost model, TLC model checking, and a seeded simulation of 20,000 subscribers replicated across ten seeds. No Zanzibar-style token can exist for entitlement, because external billers share neither a write path nor a clock; staleness bounded by the recon- ciliation interval is achievable instead. In simulation the projection dominates: applying revocations at their effective time rather than on arrival cuts expected cost 27-fold, more than every freshness parameter combined. Under partition, serving the last snapshot dominates; failing open beats failing closed for sub- scribers whenever the cost ratio ρ of false denial to over-service exceeds about 0.35, but the break-even reaches 26 when 5% of users pay. A revocation hold- over pays only against spurious revocations, never beyond the reconciliation interval, and daily reconciliation makes error nearly insensitive to notification loss. Entitlement should be engineered as an eventually consistent derived view with an effective-time projection, per-class staleness bounds, and reconciliation as its source of truth. We contribute a vocabulary, six invariants, a reference architecture, a model-checked specification, and an open simulator.