The properties of a user - what groups they belong to, what privileges they have, etc - are determined once, at login time. Any change to these will only apply to future sessions and require logging out and back in to take effect.

Rights for an entry are checked every time that entry is accessed. So if you modify the access control for an entry (e.g. via the entry's "Show Security" dialog) that should take effect right away. The only wrinkle is that if that folder or document is already open in a client application then the user is already past the rights check and won't receive an error until they attempt an operation that is not allowed. It sounds like this is what you are describing? So it's not that a logout is strictly required, but that's the simplest way to clear out information retrieved prior to the permission change.

So it really depends on how you are updating access control - are you updating users or entries? Also, frequent updates to permissions is kind of an anti-pattern. There are some legitimate cases to do it, but it should be a last resort. For instance, moving an entry can modify the effective rights that a user has, and client applications are generally responsive to changes a folder's contents, causing a refresh of the listing.