A user's role changes, but their access token still contains old claims. How would you handle that?

In production I document the maximum stale-access window for each class of permission. Low-risk reads may rely on short token lifetime, while account disable, tenant removal, or privileged administration can require a current permission-version or session check from a cache or database. That check has an availability trade-off, so the failure mode is explicit and high-risk actions fail closed. Revocation events invalidate permission caches and refresh sessions, and telemetry distinguishes expected stale-token denials from authorization-service failures.