On mongod the entire internal user cache is invalidated every time a user or role is updated.

On mongos the internal user cache is invalidated every ten minutes whether it's necessary or not.

In an ideal world:

• The cache should only be updated when an actual relevant change is made.
• Only the portion of the cache that was changed should be updated.