--- a/src/pyams_security/security.py	Mon Mar 02 10:01:38 2015 +0100
+++ b/src/pyams_security/security.py	Mon Mar 02 11:02:31 2015 +0100
@@ -117,8 +117,14 @@
                 principal_roles = self._roles_by_principal.get(principal_id) or set()
                 role_principals.remove(principal_id)
                 principal_roles.remove(role_id)
-                self._roles_by_principal[principal_id] = principal_roles
-                self._principals_by_role[role_id] = role_principals
+                if principal_roles:
+                    self._roles_by_principal[principal_id] = principal_roles
+                else:
+                    del self._roles_by_principal[principal_id]
+                if role_principals:
+                    self._principals_by_role[role_id] = role_principals
+                else:
+                    del self._principals_by_role[role_id]
                 registry.notify(RevokedRoleEvent(self, role_id, principal_id))
 
     def get_principals(self, role_id):