Don't forget the most important bit from the manual (my emphasis):
Because a security token is created during the logon of a user and does not change while that user is logged on, changes to the user’s group-membership are not visible to KiXtart until the next time the user logs on.
So if you are changing group membership you need to log off to be sure that you are not getting a stale view.
