A role taken away is no longer honoured while the new one is set up

When an administrator lowers someone’s role, for example from admin to customer success manager, that person now loses the old role’s access straight away. Until their account for the new role is ready, requests, actions and the onboarding assistant turn them away rather than letting them act with the access they no longer have.

If the platform cannot apply a role change when the person signs in, it now says so: an action they try answers that their role changed and to try again shortly, and the team gets a log line explaining why. A sign-in role the organisation does not recognise is named as such, rather than reported as a change.

Some page-level permission checks still have a follow-up of their own before this holds on every screen.