An open editor tab can keep autosaving after you remove edit access

Autosave routes get less scrutiny than the main save button. A common shortcut: the server checks edit rights when the editor opens, and the PATCH /drafts/:id route only confirms the session and that the draft exists. Every few seconds the tab sends the latest text and the server writes it.

Say a contractor loses edit rights on a contract doc at 3pm. Their tab has been open since lunch. At 3:05 they're still typing, and autosave keeps writing to the doc, because nothing on that route asks whether they can still edit.

Run the same edit check on every autosave request that you run on a manual save, against current permissions. When it fails, return 403 and have the client switch the editor to read-only with a short notice, so nobody keeps typing into a doc that quietly drops their changes.

Quick test: open a doc as an editor, remove that user's edit access from another session, then type in the first tab. If the next autosave succeeds, the route skipped the check.