During default enrollment, the CO Person Role is set to Active (when manually added) but the CO Person status is typically still Invited... this is somewhat inconsistent. Perhaps document that the Role should be set to Invited status?

Also, even though the CO Person status is "Invited" they can actually log in and do things. (That said, invitation really just confirms the deliverability of the email address...)