+1 for this.
E.g.:

If the user does not have any permissions, cache() will return array(0) { }, but !array(0) { } will return true and thus ignore the cache and reload the permissions from the database.

This can bring along some (relatively) heavy load espacially in loops.

if (! is_array($found = cache("{$userId}_groups")))

I am not sure if this is the intended way, however, it should work out.
Looking at the cache()->get() implementation for e.g. the FileHandler:

return is_array($data) ? $data['data'] : null;

I would think applying an is_null() check is more appropriate.

Good catch! I would suggest something like this:

if (null !== $found = cache("{$userId}_permissions")) 

Would you submit a PR for these changes? It sounds like the may be needed in multiple places.

On its way :)

Should be null === $found .... though, I think?

Yes! Sorry, I didn't look at the actual code, just the preview above.

This is kind of beside the point but would anybody have interest in having the cache time moved to a config file?

cache()->save("{$user->id}_groups", $cacheGroup, 300);

cache()->save("{$user->id}_groups", $cacheGroup, $config->time);

The framework recently added a default TTL value to the Cache Config. I think it would make sense for this library to use that (with the current as a fallback) so devs could change it centrally or on-the-fly.

I would think so, too.
Optimally have a $ttl in the AuthConfig (defaulting to 300 to keep the current state) that defaults to the frameworks new value if it is completely removed.
Reading your two posts again, I think thats exactly what you said 😆

Yes, agree. I think: this library should have its own Config option but should use \App\Config\Cache::$ttl as a fallback.