Event propagation is the movement of a state change from one system to other connected components. In security and privacy systems, that change may be a password reset, an account lock, a consent update, or an opt-out request. Propagation matters because the user-facing app, backend database, CRM, queue, and notification service must all agree on the current state. If one layer keeps stale data, the organization may keep sending messages, allow access that should have been removed, or fail to enforce a control.
Attackers often benefit from propagation gaps: delayed revocation, inconsistent authorization, or missing suppression can create a window where old permissions still work. Defenders reduce that risk with reliable messaging, retries, idempotent updates, audit logs, and reconciliation jobs that compare system state across services. In practice, good event propagation turns a single decision into an enforced policy everywhere it matters.