A daily email digest can list records you already lost access to

Most apps build overnight digests by joining a user's watched or subscribed rows and dumping titles into an email. The job often runs as a system account and skips the same read check the in-app list uses.

Maya watches eight projects. On Tuesday her role drops on three of them. Wednesday morning the digest still names all eight, because the worker only filtered by her user_id on the subscription table.

When you build a digest, run the current viewer's read check for each candidate item before you render the email. Drop anything that fails. If you cache subject lines, expire them when access changes, or recheck at send time.

Quick test: subscribe a limited user to five records, revoke two, trigger the digest job. The email should omit the revoked ones, with no titles in the HTML or plaintext.