Hi Nicole,
not sure if that's an issue but I've stumpled upon this behaviour and I wanted to let you know so you're aware ;-)
Assigning a new "role" group to a user that's already logged in seems only to be respected when the user properly logs in again. A simple refresh of their BE won't to the trick.
When simulating that user the be_groups.tx_begroupsroles_groups field isn't updated at all (so it seems to me).
Grüße, Philipp