Does Teleport re-evaluate aggregated role rules per request or cache them per certificate?

I am designing access revocation for Teleport-managed SSH, Kubernetes, and database targets. When a user holds multiple roles, Teleport aggregates those role rules into a short-lived certificate. I need to know whether Teleport re-evaluates the aggregated role rules on every proxied request, or caches them for the certificate or session lifetime.

Role edits may not interrupt an already issued certificate or active session. The observable effect depends on certificate TTL, re-authentication, and per-component authorization checks. Open source, Enterprise, and Cloud editions, as well as major Teleport versions, can implement role evaluation and revocation differently. Clock skew, caching, and connection pooling may further delay when a role change becomes visible.

Does Teleport re-evaluate role rules per proxied request, per certificate issuance, or per session? Which component enforces the latest role rules? How long can an active session continue using a role after that role is modified?