When Potential Matches are found during enrollment, perhaps require the petitioner to take an affirmative action, either selecting a candidate match or "create new identity". Would need to figure out what to do next... eg selecting an existing identity might imply switch to a new enrollment flow for additional role enrollment, or it could suppress/override the relevant fields on submit and link to the existing record.