To give another example we met:
- By accident a student got the role parent
- in the role parent we block the option to enrole in a course
- having the role student AND parent blocks the option to enrole.
(we find such problem quick with the script that shows all users roles (in context)