Signed invoice leak raises question: expired access or redistributed file?

At 03:07 an on-call engineer received an alert for a signed invoice downloaded after its access grant expired, and a customer had already reported a document leak. The central question is whether the access control released the file after expiry or whether an authorized recipient redistributed a copy downloaded earlier. The article argues that expiry only blocks later requests and cannot recall bytes already delivered, while watermarks add traceability but cannot prevent copying. It separates the roles of authorization, watermarking, cryptographic signing, and audit trails, noting that a signature shows whether bytes changed and an audit record shows who was authorized and when. It recommends binding each release to a recipient, invoice, issuance identifier, and digest, and logging the policy decision rather than only success.