Are we opening the door to a bit of an unlikely yet theoretically possible situation where you could exploit the cascading deletes to get yourself free entitlements. I.e. if I timed things correctly, could I bind something to make myself a sub-pool, and then try to get the unbind of that entitlement (which will delete the sub-pool) to time concurrently with the creation of a new entitlement *from* the sub-pool. If done correctly I'm wondering if that would get the client a cert, but candlepin deletes the pool without loading the new entitlement as it doesn't exist yet, but the database cleans up the entitlement row without ever revoking the cert?

Highly theoretically just gotta think hard on this delete cascade issue as it's a bit of a big change.