A service binding receives a tighter policy and one app tier keeps old rights

The secret is current, but pooled sessions still apply an older authorization view because the invalidation key never changed.