Better approach to restricting users access to managed controllers?

[eluser]gwerner[/eluser]
[quote author="Aken" date="1342138427"]Session data is refreshed on every page load. If you change session data at one point, it will be updated the next time that user refreshes their browser (either on the same or a new page). Try it out for yourself.[/quote]

If user A adjusts user B's permissions to access area C, then user B would have to login a second time to see those changes. Correct? User A wouldn't be able to change user B's session data by adjusting a field in a database. Or, maybe I'm not understanding? I'm setting the session data at time of log in.