Short answer: keep login, consent grants, and data access as three separate decisions; evaluate a category-scoped grant on every protected read, and make revocation invalidate future reads without waiting for an identity-provider migration to finish. That constraint changes the build. A managed...
Source: [Dev.to](https://dev.to/valerianblack3895/health-data-consent-3-rules-for-category-checks-grants-and-revocation-in-migration-1e7n)