Right now, to change permissions the user has to check boxes and then hit "save" or "cancel". Adding and removing roles, on the other hand, takes place immediately.

Adding and removing users from roles, on the user mgt page, also takes effect immediately.

This is confusing and inconsistent. The easiest approach is to get rid of the "save/cancel" buttons on the role admin page and have all authz changes made in either of those interfaces take place immediately.