Permanent isolation, not intermittent disconnection
An air-gapped environment is deliberately kept off any external network, permanently rather than intermittently — a fundamentally different operating condition from a device that's merely offline right now and will eventually reconnect. An air-gapped system may never reconnect by design, which means an authorization policy update can't be pushed to it the ordinary way at all; it has to be physically transported by some other means and applied locally, a sneakernet update, before it can take effect.
This constrains the environment's update cadence to whatever the physical delivery process actually allows — a policy change can't happen faster than someone can physically carry it in, which is a meaningfully different operational rhythm from a system that can simply push a change the moment it's ready.
Re-examining assumptions that don't survive the gap
Nearly every convenience a typical authorization architecture takes for granted — pushing an emergency policy update, revoking a compromised credential remotely and immediately, checking a live, centrally-managed policy source on every request — depends on network connectivity that an air-gapped environment, by design, will never have. Each of these has to be reconsidered from scratch: what does emergency revocation even mean when there's no remote channel to send it over, and what physical process substitutes for it.