Thanks for your answer RaviP - but I am not changing the access group itself, merely the version number of the application referenced by that access group. I suspect that the answer will still be "after restarting the server", but could you confirm that this is your understanding in that situation?
So for example, suppose I have an agent MyBusinessFW which has access group MyBusiness:Batch and the MyBusiness:Batch access group references version 01.01.01 of application MyBusiness, which in turn references ruleset version MyBusinessFW:01.01.01. I then make a change to a rule under version 01.02.01 of the MyBusinessFW ruleset, so I then create a new version 01.02.01 of the MyBusiness application to reference the MyBusinessFW:01.02.01 ruleset version, and update the MyBusiness:Batch access group to reference the new version 01.02.01 of the MyBusiness application. I do not need to update the agent or agent schedule because access groups are not versioned. At what point will the agent start to execute the amended version of my rule (i.e. the one in ruleset version MyBusinessFW:01.02.01) instead of the old version of the rule?
Masteragent is responsible for creating agent schedules(D-A-Q). It runs for every 60secs. Whenever there is any change in the agent rule(R-A-Q), After 60 secs when master agent runs, agent schedule gets created ideally or you need to restart the server to pick up the changes.
You should be able to stop the agent in SMA, delete the Schedule, change the AG, and restart the agent. That should pick up your changes and re-create the schedule running under the new AG without the need to restart the server.
To answer your question, it depends upon the agent type you are using :
Standard agent : After establish context, the ruleset stack of the requestor change to the user who created the queued agent. So check if this Access Group of the user who created the queue object has your latest code or ruleset versions.
For advanced agent or legacy agent, the accessgroup mentioned in security tab of the agents rule form should have access or ruleset versions. If this access group field in agents ruleform is empty, then the BATCH requestor access group comes into picture.