Let's suppose you add a user to a group and that that group has a specific set of rights to a given process. You might notice that that user has not yet received the same set of rights and as such the user cannot do the things you'd expect a member of that group to be able to do. The reason for this is K2's identity cache. This cache is something of a reflection of the Active Directory underlying K2's users and groups and as a consequence of that reflection it does not get updated in real time but rather on an 8 hour timer. The implication here is that in our scenario the user will act as a functioning member of that group only after such time as the Identity Cache has refreshed (not longer than 8 hours). If perchance you require a more immediate refresh there is a tool called the Force Identity Refresher (obtained through K2 support) that can be used to expire a user within the cache. We can then execute the Get User Details method of the UMUser smartobject to force a refresh of our expired user.