The nice thing is that you get quite a bit of middle ground to play with performance. Examples:

* Refresh TTLs that allow for some caching before hitting a DB (revoking). * Using a Bloom filter to revoke to limit the number of affected users, but also bound memory.