You can map SSO groups to database users as you like, and it can be a many-to-many relationship.
A single SSO group can be mapped to one or many database users. At login time, the SSO user specifies the database user account she wishes to use. Cyral logs show both the SSO identity and database user behind each action.
Multiple SSO groups can be mapped to a single database user account. People on your various teams can share a single database account without hurting your ability to monitor activity, since the Cyral logs show the SSO enterprise user account behind each action.