Role conflict - which one takes priority?

[bandtank]

What happens when roles have a conflict? For example, if roleA sets Account.Create = no and roleB sets Account.Create = yes, what will happen if both roles are assigned to the same user?

Similarly, what happens if the user is part of a team that has roleA and then I assign roleB directly to the user? Is the behavior different than the first case?

My goal is to create a base set of permissions for all of my users that disables access to most of the CRM areas and then give specific people more permissions. For example, all of my internal employees would get 'base_role_internal_employee' which prohibits access to most things, but then I would assign 'role_internal_manager' to managers, which would allow them to have more permissions. Say the 'base_role_internal_employee' role sets User.View = no, but 'role_internal_manager' sets it to all. What will happen? Is there a better way to do this?

[tanya]

if roleA sets Account.Create = no and roleB sets Account.Create = yes, and both roles are assigned to the same user

user can Create the entity

https://github.com/espocrm/documenta...nt.md#overview "If a user has multiple roles then they will be merged so that permissive rule will have a higher priority."

Say the 'base_role_internal_employee' role sets User.View = no, but 'role_internal_manager' sets it to all.

a regular employee has no access, a manager has it

[bandtank]

thanks