Agent WranglersRoles and permissions Required
Make role changes count on the next request
Apply a removed role or permission from the user's next request. Never keep roles only inside a long-lived token or cache.
How to do it
Load the membership on each request, or cache it for at most 60 seconds and clear the cache on every change. If access tokens carry roles, keep their life at 5 minutes or less, or compare a membership version on each request. Removing someone from an organisation follows remove access when someone leaves.
How to check
Demote a signed-in test admin to viewer. Within 60 seconds, their next admin request answers 403.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate.