This is one of the proposed solutions to (the other being implementing support for refresh tokens in the UI/Stripes).

The idea is to validate user deactivation (and potentially other user properties, e.g expiration or removal) at the time the token is checked in mod-authtoken. This would be similar to how permissions are enforced.

The benefit of this approach is that it can be introduced transparently to the FOLIO UI and other clients (e.g edge modules).

The disadvantage is that it would impose additional performance penalty on the auth check operation – to limit this penalty we would need to cache the user record between auth checks.