When a permission is enabled, it’ll set the access flag to allow.
Blocking a permission on a role sets it to deny, preventing any
other role from overriding that permission.
- Example:
- If the role Workflow Blocked has the
Access to Workflow modulepermission blocked, and the built-in role DNS approvers has this permission enabled, assigning the userjanedoeto both roles will block access to the Workflow module. The permission granted by the DNS approvers role is overridden by the permission denied by the Workflow Blocked role.
Note: Permissions not explicitly set are returned as
null. These undefined access flags are not the same as
deny and can be overridden by access flags set in other
roles.