---
title: "Make role changes count on the next · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate
updated: 2026-10-20
licence: "All rights reserved"
---

# Make role changes count on the next request

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions)
- Rule: Apply a removed role or permission within 60 seconds of the change. Never keep roles only inside a long-lived token or cache.
- How: Load the membership on each request, or cache it for at most 60 seconds and clear the cache on every change. If access tokens carry roles, keep their life at 60 seconds or less, or compare a membership version on each request. Removing someone from an organisation follows [remove access when someone leaves](https://agentwranglers.se/playbook/accounts/organisations-and-teams/member-removal).
- Check: Demote a signed-in test admin to viewer. Within 60 seconds, their next admin request answers 403.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate`.

- Previous: [Give roles inside an organisation](https://agentwranglers.se/playbook/accounts/roles-and-permissions/org-scoped-roles)
- Next: [Limit tokens and agents to what their owner may do](https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions)
- [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions)