After updating your XAF project to 17.2.5, you may notice a new option in the Application Designer:
The new SecurityStrategy.RolesMergingMode property specifies how the Security System determines if a user can perform a specific operation in case this user has multiple roles with different permission sets. The available modes are listed in the RolesMergingMode enumeration.