One of the guys that tested the ERP I'm developing has noticed the following:
When a user role changes, this should be reflected immediatelly in the system. At this time the changes in user permissions is evident only when the user relogin.
I agree with the tester, however, I'm not sure which approach I should use to solve this problem. Let's suppose a user has "payment" role assigned, then the admin of the system decided remove this role from this user, however the user is doing some work. What should I do? Refresh the entire user interface cancelling all the tasks he is doing, verify if the task he is working on is related to the role he left and refresh the UI in this case or wait until he finishes his work and only then refresh the UI?