Same user part of multiple groups, Reflecting least permissions rather than highest permissions

[manikanta_jana]

Use Case: We have a user which is part of multiple groups (Group 1 , Group 2 and Administrator) 

Group 1 : does not have permission to activate and delete etc. permissions. 

Group 2: Delete Permissions. 

Administrator : have all administrator group permissions.

When user logged into AEM, He is not able to see Delete , Activate permissions as Administrator Group will have. Rather it is taking priority of deny permissions. 

Is there any way i can come out of this issue. 

Thanks,

Manikanta.

[Sham_HC · Accepted solution]

Evaluation is bottom up. Refer details at https://docs.adobe.com/docs/en/cq/5-6-1/administering/security.html#Access%20Control%20Lists%20and%2...

[justin_at_adobe]

Hi,

Why is a deny ACE being used at all? That shouldn't be necessary in this case.

Regards,

Justin