core/lib/Drupal/Core/Cache/Context/AccountPermissionsCacheContext.php | 4 ++++
 core/modules/node/src/Cache/NodeAccessGrantsCacheContext.php          | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/core/lib/Drupal/Core/Cache/Context/AccountPermissionsCacheContext.php b/core/lib/Drupal/Core/Cache/Context/AccountPermissionsCacheContext.php
index d72e697..4fda3fb 100644
--- a/core/lib/Drupal/Core/Cache/Context/AccountPermissionsCacheContext.php
+++ b/core/lib/Drupal/Core/Cache/Context/AccountPermissionsCacheContext.php
@@ -57,7 +57,11 @@ public function getContext() {
    */
   public function getCacheableMetadata() {
     $cacheable_metadata = new CacheableMetadata();
+
+    // The permissions hash changes when:
+    // - a user is updated to have different roles;
     $tags = ['user:' . $this->user->id()];
+    // - a role is updated to have different permissions.
     foreach ($this->user->getRoles() as $rid) {
       $tags[] = "config:user.role.$rid";
     }
diff --git a/core/modules/node/src/Cache/NodeAccessGrantsCacheContext.php b/core/modules/node/src/Cache/NodeAccessGrantsCacheContext.php
index 42a1ed9..767d286 100644
--- a/core/modules/node/src/Cache/NodeAccessGrantsCacheContext.php
+++ b/core/modules/node/src/Cache/NodeAccessGrantsCacheContext.php
@@ -93,6 +93,9 @@ public function getCacheableMetadata($operation = NULL) {
       return $cacheable_metadata;
     }
 
+    // The node grants may change if the user is updated. (The max-age is set to
+    // zero below, but sites may override this cache context, and change it to a
+    // non-zero value. In such cases, this cache tag is needed for correctness.)
     $cacheable_metadata->setCacheTags(['user:' . $this->user->id()]);
 
     // If the site is using node grants, this cache context can not be