Apologies Woody!- let me correct my scenario
I did not create one user with two roles assigned , it was two separate users one having the reseller role assigned and the other has reseller read only role assigned on creation.
The issue is both these users showed as no role assigned when I checked in the user list afterwards , which is why it gave the 403 error while trying to login as one of these users , I couldn’t reproduce it, so the question is whether a single user created with a single role can ever end up with no role assigned if something in the creation step fails silently.