This is looking really good so far! I think I wasn't completely clear when explaining some things to you, that's definitely on me- the comments I left should address those.

I think an overarching idea is that on their own, custom user data documents don't do anything. They are just extra fields of information you can store for a user. You can reference custom user data in your roles, and the way your roles are set up will determine the permissions for a user.

Let me know if you have any more questions about anything!

Also I know I provided you with the current example, but I actually think it would make sense to simplify the example to just the example provided in the Jira ticket. So for example with the following custom user data document:

{
   "_id": "63ed2erealobjectid78e526",
    "user_id": "63ed2dbe5960df2af7fd216e",
    "canRead": true,
    "canWrite": true,
}

If you wanted to remove this user's document and have the resulting permissions be automatically reflected for the user's sessions, you should first unset all of their non-ID fields. After that change, the above document would become:

{
   "_id": "63ed2erealobjectid78e526",
    "user_id": "63ed2dbe5960df2af7fd216e",
}

and the user's permissions will automatically refresh according to the roles. After that you can safely delete the custom user data document if you wish.

Everything looks good technically! I just left a couple of super nitpicky optional nitpicks, but I'll leave it up to you to decide whether you want to make the changes.

one suggestion, but otherwise lgtm!