Permissions/access caching per node and per user UPDATE: Narrowing this a bit. I need to, for either (a) all nodes of a given type or (b) all nodes on a specified list of node id's or (c) all users on a list of iser id's, clear the cached permissions because, due to changes not necessarily made on a given node, a user's access permission may have changed.

I have built and published a module (Access by Reference) that grants update access to nodes based on edit permissions on nodes referenced in the target node.

I am concerned that the module will not work as intended if permissions cache interferes with recognizing changes made elsewhere (eg, rights to the referenced node are changed)

What I would like to do is clear permissions caches relating to particular nodes and/or particular users or roles.  I've been studying the Cache Contexts for several days but the light bulb has not yet lit.  I'd appreciate some guidance.
Access results can store cache metadata like cache tags and cache contexts. As a shortcut AccessResult has two specific methods to apply the correct cache metadata. Different membership in roles or a modified role results in a different set of permissions, use cachePerPermissions() to add a cache context for the hashed permissions. The second method is for the cache context of the current user cachePerUser().

If you get field data from a node or user, add addCacheableDependency($node) or addCacheableDependency($user). 

See this example from the node module:

core/modules/node/node.module, line 938

function node_node_access(NodeInterface $node, $op, $account) {
  $type = $node
    -&gt;bundle();
  switch ($op) {
    case 'create':
      return AccessResult::allowedIfHasPermission($account, 'create ' . $type . ' content');
    case 'update':
      if ($account
        -&gt;hasPermission('edit any ' . $type . ' content', $account)) {
        return AccessResult::allowed()
          -&gt;cachePerPermissions();
      }
      else {
        return AccessResult::allowedIf($account
          -&gt;hasPermission('edit own ' . $type . ' content', $account) &amp;&amp; $account
          -&gt;id() == $node
          -&gt;getOwnerId())
          -&gt;cachePerPermissions()
          -&gt;cachePerUser()
          -&gt;addCacheableDependency($node);
      }