Revoking access rights

Hi all,

when are the access rights to various objects in ONe verified?

Example:
I have a VNet used for a specific lesson/course at our university. Students of this course get added to a dedicated (secondary) group, and the VNet is assigned to this group with “use” permission.Students can instantiate their VMs connected to this VNet as expected. However, we have discovered that when the student gets removed from the group and his VM connected to that network gets undeployed, he can still deploy it again, even though he should not be able to use that network.

Are the access rights verified only when the VM gets created?
Thanks!

-Yenya