This short video shows how IdentityNow uses Access Profiles to help define and govern access for your organization.
In the video you made a statement that entitlements can be automatically removed when a user transitions into a different role. I am not getting the result you mentioned in testing, rather I can only add entitlements. Is this something that has to be enabled by your team?
This functionality will be available in the next month or so.