Example 1: Permission Inheritance from Multiple Groups

This example illustrates how an object can inherit multiple permissions from groups that are granted permission on a parent object.

In this example, two permissions are assigned on the same object for two different groups.

• PowerOnVMRole can power on virtual machines.
• SnapShotRole can take snapshots of virtual machines.
• PowerOnVMGroup is granted the PowerOnVMRole on VM Folder, with the permission set to propagate to child objects.
• SnapShotGroup is granted the SnapShotRole on VM Folder, with the permission set to propagate to child objects.
• User 1 is not assigned specific privileges.

User 1, who belongs to both the PowerOnVMGroup and the SnapShotGroup, logs in. User 1 can both power on and take snapshots of both VM A and VM B.

Figure 1. Example 1: Permission Inheritance from Multiple Groups