So I have multiple pega applications in the same environment.  I am using Okta and each application has its own authentication service.  Upon first attempt to login the operator gets created with a certain primary access group as setup for that authentication service.  

If a user attempts to login to a different application thru Okta than previous logins then post authentication activity of the appropriate auth service gets executed but it will use the ruleset stack of the primary access group that the operator had been created with pertaining to the first application which means then that to be able to reconstruct the access groups in the operator to give access to the second application then that second applications role mapping code would need to be in the first applications ruleset stack.  

Because of this, we are not allowed to completely segregate the code for one application from another application.  Does this make sense? Or are we perhaps doing something wrong?  Is there really no way to completely segregate the applications?