Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group.
Then, the user stops being a member of the group.
Since access checks are performed at the time of opening the file, the user can still access the file, indefinitely, using the open handle. If new data is written in to the file, the user can access the new data.
How can this situation be detected and prevented?