We have the users migration running every 2 minutes. This includes the roles migration (with --update flag) and the users with our custom high water mark.
When certain permissions are changed on certain roles, these are reset every time that the migration runs.
We don't really need the --update flag in the migration, so remove it.
This was committed here already: https://git.drupalcode.org/project/drupalorg_migrate/-/commit/a9cc72a92e...
Fixed
1.0
Code