Which role takes precedence when users have overlapping privileges?

Firebird implements a Role-Based Access Control (RBAC) system where administrators use GRANT and REVOKE statements to enforce least-privilege access. In complex environments, a single user may be assigned multiple roles that grant overlapping or conflicting permissions to the same database objects.

While the system allows for multiple role assignments, the behavior regarding privilege inheritance and precedence remains unclear when these roles intersect. Specifically, it is uncertain how the engine resolves access when one role grants a privilege that another assigned role does not explicitly provide or restricts.

Does Firebird treat overlapping role privileges as additive, or is there a specific hierarchy that determines the effective permission set? How is the final access level calculated when a user activates multiple roles simultaneously?