Role assignments

I’m trying to wrap my head around how an architecture can get so tangled that a single subscription ends up using almost every role assignment it’s allowed. We have an older platform in the same tenant where nearly everything was stuffed into one subscription, and it shows, they’ve burned through about 95% of the available role assignments...