The Allow permission overrides the Do Nothing (when neither Allow nor Deny is checked) permission. The Deny permission overrides the Allow permission. For example, according to the following figure:
For example, say you allow the Read & View permission on an object, deny the Admin permission on that same object, and leave the Edit, Remove, and Create permissions unspecified. With this configuration—
- You have Read & View permission on this object. You can view and read this object unless it is denied higher up in the hierarchy.
- You do not have Edit permission on this object. You cannot edit this object unless you are given the Edit permission elsewhere.
- You do not have Remove permission on this object. You cannot remove this object unless you are given the Remove permission elsewhere.
- You do not have Create permission on this object. You cannot create objects here unless you are given the Create permission elsewhere.
- You do not have Admin permission on this object. You cannot perform as Admin on the object even if you are given Admin permission is allowed higher up in the hierarchy.