Role changes propagate by invalidating existing JWTs using user versioning, short-lived tokens, or a blacklist, forcing clients to obtain new tokens with updated claims.

Because JWTs are immutable, a role change (e.g., Admin → User) is not automatically reflected in previously issued tokens. To enforce the new role, you must revoke old tokens and issue new ones. The most common method is user versioning: store a role_version integer in the user record, include it in the JWT claim, and increment the version on role change. The token validation middleware then compares the token's version with the current version; if mismatched, the token is rejected and the client must re-authenticate.

Role Version Example