role_assigned() only checks direct/permanent roleAssignments. PIM-managed assignments are in roleAssignmentSchedules and won't be found, producing noisy (non-blocking) output on re-runs against tenants with PIM-assigned roles (e.g. Cascades). TODO comment added at the helper — Howard to implement the fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>