The current definition for IdentityCriteriaType Application is
"The rule specifies the combination of an application identity and an Anonymous UserIdentityToken."

Randy indicated in a discussion in the security WG that the limitation to allow the Application authentication criteria type only with anonymous user token would be a unnecessary limitation.

When adding this feature, the assumption was that this is used for headless applications that do not have a user.

I do not know if it is a use case that in one session, one role is assigned based on the application identity and another role is assigned based on the user token.
I think we should keep the use case headless device simple and we should not introduce additional special logic without having a use case.