Only the roles/resources should be revokable, which were assigned manually. The resources, which are assigned indirectly via roles (the same for roles via other roles) will be reassigned later on by the system automatically, which is misleading, confusing for the end user.

by: Erzsebet S. | over a year ago | Role Based Provisioning