Answer
Implement AD-synchronization Role Mappings: configure a correspondence between specific Active Directory user groups and their equivalent IFS user groups/roles. Once configured, simply moving a user between the relevant AD groups, rather than manually reconfiguring their IFS roles directly, causes the next AD sync job to automatically apply the corresponding role/group change on the IFS side. This is the standard way to have IFS role/permission assignments automatically follow AD group membership changes as personnel move between departments or roles.