A table carries a read access control rule, and one field on that same table carries its own read access control rule. A user opens a record and the platform must decide whether that single field is rendered. How are the two rules evaluated?
- AOnly the field level rule is considered, because once a rule exists at field level the table level rule is treated as superseded for that field.
- BThe two rules are combined so that passing either one is sufficient, and the field renders as soon as the user satisfies the less restrictive of them.
- CBoth rules must grant read, with the more specific field level rule evaluated first and the table level rule then evaluated as well before the field is rendered. Correct
- DThe table level rule is evaluated first, and if it grants read the field level rule is skipped because access has already been established for the record.
Why A is wrong: Tempting because the field rule is the more specific of the two, but specificity governs evaluation order rather than which rule can be skipped.
Why B is wrong: Tempting because multiple rules at the same level are indeed combined permissively, but rules at different levels are not, and the field would leak data if this were true.
Why C is correct: Correct because the platform evaluates from most specific to least specific and requires the user to pass at each level before the field is shown.
Why D is wrong: Tempting because it reflects the intuition that broad permission implies narrow permission, but it reverses the evaluation order and would make every field rule pointless.