And actually, having duplicate roles is not really a problem (and should not happen if using ZfcRbac). If a role has a permission, checking multiple times the same role is not a problem and will lead to the same result).