This is because of something called attribute assignment when access is granted using access requests. View my other response here where I explained this concept for IIQ and Salesforces, but it is most likely the same in IDN for your single-valued entitlement attribute.