Right now we rely on the period cache flush to update the mongos' view of user's privileges. On mongoses other than the one the user/role manipulation was done on, that's the best you can do. But on the mongos that was used, you should be able to invalidate the cache right away so the new permissions take affect immediately.