Just-in-time admin approval succeeds, but the bastion PAM cache still enforces the previous group membership

Operators receive the right entitlement in the identity plane, yet the bastion keeps denying access until its local authorization cache expires.