Extended attributes and roles

Hello devs! I need to match an entitlement’s extended attribute with an identity’s attribute. If they match, I would assign the identity to a generic role that grants the entitlement associated with the extended attribute. However, I’m not sure if this is the best approach or if there might be a better solution. Any insights or suggestions would be greatly appreciated! Thank you