Plenty of apps store access grants against a group name that comes from the identity provider: engineering-leads can edit the roadmap, finance can see invoices. When someone deletes the group in Okta or Entra ID, the app usually never hears about it, so the grant rows stay in its database.
Months later somebody creates a new group and happens to pick the same name. Maybe it's a different team, or a contractor group someone named carelessly. The next time its members sign in, their token carries groups: ["finance"], the app matches on the string, and they can open every invoice the old finance group could.
Key grants on the IdP's immutable group ID (the object ID in Entra ID, the group id in Okta) and keep the display name only for showing in the UI. When a directory sync or SCIM push reports a group as deleted, delete its grants in the same transaction. If you can't get delete events, run a periodic job that compares the groups you hold grants for against the IdP and flags the ones that no longer exist.
To test it, grant a test group access to one record, delete the group in your IdP, create a new group with the same name, add a user to it and sign in as that user. If they can open the record, your app is trusting the name.
