Duplicate assignments
RoPE only allows an identity to have a single CRA per system/resource/account name combination. Therefore, if an identity has two assignments for the same resource, RoPE merges them into one. An identity can, for example, have two assignments if there are two assignment policies that assign the same resource to it.