Hello @Marcus
Are you asking in which order is Role membership determined (top down, merged, etc?) Roles are a collection of various permissions and assignments. They work similarly to Active Directory Security Groups, and thus a User will be a member of all Roles assigned. This can be done directly in the Cloud Manager, or be mapped to a Security group in your on Prem AD.
You can actually assign roles both ways, based on preference or business need.
As a reminder, you can get more details on all sections of the Cloud manager by using the "Learn more" link in the section you are working on.
For roles, more info is here;
https://docs.centrify.com/en/centrify/adminref/index.html?version=37#page/cloudhelp%2Frole-create-ad...
I hope this helps answer your question. If not, please provide a bit more information on what you are working on.
Have a great weekend!
-Ryan V
