Effects of group membership

Users and Groups, in addition to the directly assigned permissions, inherit permissions by virtue of their membership to another Group. Transitive memberships enable permission inheritance beyond the direct parent group. Permissions of a Principal and parent groups, are additive when obtaining effective permissions for the Principal.

Under all circumstances user permissions override group permissions when the user is a member (immediate or transitive). This is possible when both the user and the group have overridden permissions on a secured resource.