A multi-step wizard can finish with access checked only on step one

Long create or edit flows often authorize once when the wizard opens. Later steps trust that first decision and write on submit. Access can change while the user is still on step three: someone removes them from the project, a share expires, or a role change lands.

Sam opens "Create invoice" on a project they can edit. While they fill line items, an admin revokes Sam's write on that project. Submit still succeeds because the server only checked access when the wizard started, minutes earlier.

Authorize again on every step transition that loads restricted data, and once more in the final submit handler against the same resource and action you will write. Treat the opening check as UX only. If the final check fails, refuse the write and send the user back with a clear error, not a partial save.

Quick test: open a multi-step create flow as a user with write access, revoke that write mid-flow without closing the browser tab, then submit. The write must fail, and no new record should appear.