How do ACLs search?

How do ACLs search?

• A. Most specific to most generic
• B. Most generic to most specific
• C. Alphabetically by name
• D. Random order

Answer: (A)

ACLs are checked from most specific to most generic. The system starts with the narrowly scoped rules—such as field-level or a rule tied to a specific user or record—and only moves to broader, table-level rules if no specific match is found. This ordering ensures that precise restrictions win over general allowances, so a particular restriction can block access even when a broader rule would permit it. For example, a specific field-level ACL targeting one user will be evaluated before a general table-level ACL that grants access to everyone with a certain role; if the specific rule applies, it determines the outcome. If no specific ACL matches, the evaluation proceeds to less specific rules, and access is granted only if a matching rule permits it; if nothing matches, access is denied.

ACLs are checked from most specific to most generic. The system starts with the narrowly scoped rules—such as field-level or a rule tied to a specific user or record—and only moves to broader, table-level rules if no specific match is found. This ordering ensures that precise restrictions win over general allowances, so a particular restriction can block access even when a broader rule would permit it. For example, a specific field-level ACL targeting one user will be evaluated before a general table-level ACL that grants access to everyone with a certain role; if the specific rule applies, it determines the outcome. If no specific ACL matches, the evaluation proceeds to less specific rules, and access is granted only if a matching rule permits it; if nothing matches, access is denied.