How does Weblate resolve conflicting permissions when a user belongs to multiple groups with different access levels?

Permission Resolution in Multi-Group Scenarios

Weblate implements role-based access control where users can inherit permissions from multiple groups across different authentication backends. The documentation indicates that users receive combined permissions from all their group memberships, but does not explicitly define how conflicts are resolved when groups grant contradictory access levels.

For example, if a user belongs to a group with translation rights on Project A and another group with read-only access to the same project, the effective permission level is unclear. This ambiguity becomes critical in organizations with complex LDAP group hierarchies or when migrating from simpler permission models.

The constraint requires verifying actual behavior through testing rather than relying on documentation alone. Default permission schemes may interact unexpectedly with inherited group permissions, potentially creating security gaps or access denials.

Which permission takes precedence when group memberships provide conflicting access levels, and how can administrators predict effective permissions without manual testing of each user's group combination?