In D6 user_access() has a $reset parameter, which allows resetting the permissions cache if roles are added on the fly.

$reset (optional) Resets the user's permissions cache, which will result in a recalculation of the user's permissions. This is necessary to support dynamically added user roles.

How to do this properly in D7?

Comments

bajnokk’s picture

Answering myself: it is drupal_static_reset('user_access') which clears static cache.
It was not clear to me that the static cache lasts for one page load, so this affects only the user generating the page load.