Multiple Permission Settings

Objects might have multiple permissions, but only one permission for each user or group. For example, one permission might specify that GroupAdmin has the Administrator role on an object. Another permission might specify that the GroupVMAdmin has the Virtual Machine Administrator role on the same object. However, the GroupVMAdmin group cannot have another permission for the same GroupVMAdmin on this object.

A child object inherits the permissions of its parent if the parent’s propagate property is set to true. A permission that is set directly on a child object overrides the permission in the parent object. See Example 2: Child Permissions Overriding Parent Permissions.

If multiple group roles are defined on the same object, and a user belongs to two or more of those groups, two situations are possible:

• No permission for the user is defined directly on the object. In that case, the user gets the union of the permissions that the groups have on the object.
• A permission for the user is defined directly on the object. In that case, the permissions for the user take precedence over all group permissions.