Record-Level Security (RLS) Permission Evaluation for Complex Role Hierarchies

SurrealDB utilizes PERMISSIONS clauses on tables and records to enforce fine-grained access control. These expressions typically evaluate the current session's user attributes against record data to determine if a SELECT, CREATE, UPDATE, or DELETE action is permitted.

When implementing DEFINE ROLE for scalable management, there is a need to handle overlapping permission boundaries where a user may belong to multiple roles with conflicting or additive access rights. The current documentation outlines basic boolean expressions, but the behavior regarding priority or union of permissions across multiple assigned roles remains unclear.

Does SurrealDB evaluate multiple role-based permissions as a logical OR (granting access if any role permits it) or is there a priority hierarchy? How does the engine handle a scenario where one role explicitly denies access while another permits it for the same record?