I think the online schema migration stuff might be a bit confusing; when you update the schema, all permission computations (within the window) will make use of the new schema