PermissionDenied error when adding role mid-session in FaunaDB

Goal

Validate whether FaunaDB evaluates role permissions dynamically during a session or only at the start of a query. The test involves creating a user with a limited role, performing a forbidden operation, then adding an additional role to the same session and retrying the operation.

Constraints & Uncertainties

• Use test credentials to avoid accidental privilege escalation.
• Ensure the session is not refreshed between role changes to isolate dynamic evaluation.
• Current FaunaDB documentation does not explicitly state if role changes take effect mid-session.

Unresolved Questions

1. Does FaunaDB re-evaluate the effective permission set each time a query is executed, allowing newly added roles to grant previously denied access?
2. If roles can be added mid-session, what is the mechanism for updating the session’s role set without creating a new session?
3. Are there any limits or best‑practice recommendations for dynamically altering roles during an active session?