Currently the roles are saved as part of the user object in the space. If I change the roles this is not reflected for the existing roles/space/user mappings.

Either we should only save the id of the role and lookup the permissions that way, or we should modify the user/space/role mapping when saving the role and update all users. I thin the second one is the better one and is easier to implement (only modify the save role).