So from What is ASP.NET Identity's IUserSecurityStampStore interface? we learn that ASP.NET Identity has a security stamp feature that is used to invalidate
You stated your options correctly, either low interval/waiting or hooking your own custom OnValidateIdentity.
OnValidateIdentity
Here's a similar question: Propagate role changes immediately