The Aruba controller assigns user roles based on a specific hierarchy of precedence. The process flows from the base configuration to specific overrides:

1. Initial role assigned: This is the starting point. When a user first associates with the SSID (before authentication completes), they are assigned the "Initial Role" configured in the AAA profile.
2. Authentication default role: Upon successful authentication, the system applies the default role specified in the authentication profile (e.g., 802.1X or MAC authentication profile). This overrides the initial role.
3. User derived role: The controller then checks for User Derivation Rules (UDRs) configured locally on the controller (based on attributes like SSID, VLAN, or MAC OUI). If a match is found, this role takes precedence over the authentication default role.
4. Server derived role: Finally, if the authentication server (RADIUS) returns a Vendor Specific Attribute (VSA) specifying a role, this Server Derived Role takes the highest precedence and overrides all previous roles.

Aruba Networks (HPE), ArubaOS 8.6.0.0 User Guide, "User Roles" section, subsection "Role Derivation." This section explicitly states: "The following is the order of precedence for role assignment (from highest to lowest): 1. Server-derived role 2. User-derived role 3. Default role 4. Initial role."

Aruba Networks (HPE), Aruba Certified Mobility Associate (ACMA) Study Guide, Chapter on "Firewall Roles and Policies," describing the hierarchy of role assignment where Server Derived roles override User Derived rules, which in turn override Default roles.