column-masks-reapplied-on-cached-results-for-immediate-revocation

In R-Dash widget-data service, column masks are re-applied on cached QueryResults at read time — not only at write time. This defense-in-depth ensures role revocation takes effect immediately even for already-cached data, preventing stale mask bypass when a user’s permissions change between cache fill and cache read.