Via either database constraints or controller checks, don't allow the same org identity to be added to the same CO as a second CO Person. (Additional person roles should be added instead.)