In addition to the access control principles, there are some basic access control rules that might help you to understand how things work:
-
You might belong to multiple groups. Every aPriori user belongs to at least the all users group. Your administrator has probably also made you a member of one or more other groups that reflect something like your region, or the project(s) you work on, or the type of work you do.
-
In general, to have access permission to a entity, you must belong to at least one group that grants that permission, and not belong to any group that denies that permission. However, administrators can tweak this rule so that grants and denials are strengthened or weakened.
-
The most restrictive permission is the one that counts. For example, you might belong to one group that allows you to update a component and to another group that explicitly prohibits you from updating that component. In this case, the deny permission takes precedence and you update the component.