When there are multiple roles assigned to a user and the access controls are ambiguous, AAM fails to properly take into consideration defined access controls.

Internal refactoring needed to cover this edge case.