Hi all,
I’m currently setting up roles and permissions in Directus, and I have a few questions regarding how the system handles policy evaluation:
-
Does the order of policies matter?
For example, if I have a general “deny all” policy followed by a more specific “allow” policy for certain users or conditions — which one takes precedence? -
How do parent roles and user-specific permissions interact?
If a user has a role with certain permissions, and I also define specific policies for that user directly, which one is applied first or takes priority? -
Do user-level policies override role-based ones?
What happens when a parent role is assigned to another role — how is inheritance handled in practice?
Any clarification or examples would be really appreciated!
Thanks in advance 