Where org identities are NOT pooled, if an identifier is listed in cm_identifiers twice (once for the COmanage CO and once for another CO), and the org identity id for the COmanage CO is greater (so it is returned second by the database), then the identity is not correctly linked to grant CMP privileges.

That is, the query

select * from cm_identifiers where identifier='someeppn' and login='true' and status='A'

returns two rows, with the second one (value of the id column is larger) being attached to the org identity attached to the COmanage CO.