On a set of RHEL 5 servers, the QAS cache is not fully updated as expected. We set the following vas.conf settings in order to ensure the cache would be up-to-date with the user's group information:
User's membership was changed after the flush. Product working as expected.
Nested memberships will only be pre-loaded on a FLUSH only. QAS will not continue to query the nested memberships, so any changes to them after the flush will not be picked up until a login event for that user or another flush.