Within system, create some remote objects and listen for recordChanged, recordAdded and recordRemoved OR setup methods to call from the system service events, then call these within. Determine who to update with this information (by checking property details, role properties, etc), then fire the relevant system remote objects
When a role is given and taken from a user, update the user with the new relevant client data (that may involve removing data too)