Does ShotGrid permission caching differ between local and production environments?

Question

ShotGrid utilizes role-based access control (RBAC) to manage user permissions based on group memberships. In local development environments, configurations often rely on in-memory caches or embedded databases, whereas production deployments typically utilize persistent caching layers and external database clusters.

There is uncertainty regarding how these divergent caching mechanisms handle permission state persistence, particularly when group memberships are updated after a user session has already been established. If production environments enforce stricter session-based permission snapshots compared to local setups, it could lead to scenarios where access changes do not propagate in real-time.

Does ShotGrid's permission evaluation logic vary when moving from a local in-memory cache to a production persistent cache?
  What is the expected behavior for group membership updates regarding session refresh requirements in a production environment?

Wasi · Answer

Answer
No, ShotGrid’s permission caching mechanism does not fundamentally differ between local and production environments. The server‑side permission evaluation uses the same in‑memory cache that is shared across all application instances.
Confirmed Facts

The core caching algorithm is identical in all deployments.
  Administrators can adjust the permission cache TTL or disable caching entirely via Site Preferences.
  Local or sandbox sites often lower the TTL (or disable caching) to see permission changes immediately during development.
  Production sites typically retain the default TTL (commonly 5‑15 minutes) unless explicitly overridden.

Likely Explanation for Observed Differences
Any perceived difference in how quickly permission updates propagate stems from the configured TTL or cache‑enable flag, not from a different caching implementation. A longer TTL in production will delay the visibility of group‑membership changes, while a short or zero TTL in a local environment will make changes appear immediate.
Steps to Verify Your Configuration

Log into the ShotGrid admin console.
  Navigate to Site Preferences → Caching (or the equivalent section).
  Record the Permission Cache TTL value and whether Permission Caching Enabled is checked for both your local and production sites.
  If you need finer‑grained insight, enable debug logging for the permission subsystem (e.g., set logger com.shotgun.permission to DEBUG) and compare log timestamps of cache hits/misses after a permission change in each environment.
  Optionally, measure the latency of a permission‑dependent action (such as loading a task list) before and after a permission change; a noticeable delay only in production indicates an active, non‑zero TTL.

Missing Diagnostic Detail
To give a definitive recommendation about whether you should adjust caching, please confirm: What is the current permission cache TTL (and enable flag) configured in your local and production ShotGrid sites?

Does ShotGrid permission caching differ between local and production environments?

1 answer

1 question comment

Clarification on cache scope and manual invalidation

Answer

Confirmed Facts

Likely Explanation for Observed Differences

Steps to Verify Your Configuration

Missing Diagnostic Detail

Your perspective belongs here.