Which of the following is the correct order of components in an ACL evaluation?

Which of the following is the correct order of components in an ACL evaluation?

• A. role, condition, script
• B. condition, role, script
• C. script, role, condition
• D. role, script, condition

Answer: (A)

ACL evaluation proceeds in this order: first the system checks whether the user has the required roles for the ACL, then it evaluates the condition on the target record, and finally it runs the script for any additional, programmable checks. If the user lacks the necessary role, access is denied immediately, so there’s no need to evaluate the condition or run the script. If the role check passes, the condition is evaluated; if it’s true (or blank, which is treated as true), the script runs to perform more complex checks. Only when the script returns true is access granted. This sequencing—role, then condition, then script—ensures efficiency and proper security. The option that reflects this exact order (role, then condition, then script) is the correct one.

ACL evaluation proceeds in this order: first the system checks whether the user has the required roles for the ACL, then it evaluates the condition on the target record, and finally it runs the script for any additional, programmable checks. If the user lacks the necessary role, access is denied immediately, so there’s no need to evaluate the condition or run the script. If the role check passes, the condition is evaluated; if it’s true (or blank, which is treated as true), the script runs to perform more complex checks. Only when the script returns true is access granted. This sequencing—role, then condition, then script—ensures efficiency and proper security. The option that reflects this exact order (role, then condition, then script) is the correct one.