I don’t have a solution, I share your pain. One thing I noticed is that the roles often didn’t update till I generated a fresh session cookie. Until then it persisted on the old rights seemingly unchanged which made testing requirements for RBAC… interesting.
