Hi Felipe,
Even I am struggling to get that.We are also using business role as position and BR are mitigated. But when assigned to user( having no existing roles) it shows risk.
We again go for mitigation at user level by BR owner.Please let me know if you get any solution for this.
Thanks,
Mamoon