Stop access checking once a relevant Access of Role to Object instance explicitly denies or grants access

[VenkatRajGopal]

Hi,

With reference to the Usecase mentioned in the above screenshot, Ordering:AssociateManagers access group has Ordering:AssociateManagerDeny & Ordering:Manager access roles.

AssociateManagerDeny role just checks whether order value is within threshold. It doesnot confirm that the AssociateManager has Manager privileges.

If we select " Stop access checking once a relevant Access of Role to Object instance explicitly denies or grants access" in AssociateManagerDeny role and it grants access in it, the validation of Ordering:Manager access role will be skipped and any important restriction mentioned in the role will be ignored?

I guess I am missing something here. Can someone please clarify this.

[Anoop_Krishna]

@VenkatRajGopal AssociateManagerDeny role is just to deny the opening of order items, so it is created on order class. It just checks the instances of order items and decides whether to deny access or not.

Regarding the access for other class instances , all those are mentioned in the Manager access role.

If deny is true on order items from AssociateManagerdeny role, then access providing ARO of order class will not be checked in the manager role. But all other AROs will be checked for other accesses.