The group policy can be selected by certificate attributes or by an authentication server. The group policy can lock users into a specific tunnel group. You can have more than one group policy lock users into the same tunnel group.
You use multiple group policies to change attributes based on the certificate/AAA. If some value, like the pool, does not change for every group policy, you put it in the tunnel group as a default. If you could not do this, you would have to separately enter the pool into each and every group policy.
Here's a simple example:
https://supportforums.cisco.com/docs/DOC-1746
Note this is why you can have three different states for some booleans, e.g.
"re-xauth enable"
"re-xauth disable"
"no re-xauth enable/no re-xauth disable"
These are three different values. The first two override the default, the third allows the default to set the value.
