Permissions can be assigned using positive and negative lists (if enabled). In most cases, you will work with positive lists. A negative list is useful in the following situations:
- You wish to limit access for only some users (positive list: WORLD with write permission; negative list: some users without write permission). Please make sure that the positive list contains, in any case, at least one entry (usually WORLD).
- You want to deprive all users from access to a module or function (negative list: WORLD without read permission). This can be necessary, e.g., during system maintenance times.
Please, in any case, also be aware of the following rules:
- If all permission lists are empty, there are no restrictions. The object concerned is writable or executable for all profiles.
- As soon as a permission list is not empty, only the permissions apply that were explicitly granted in the positive list, except those that were explicitly revoked in the negative list.
- A negative list has priority over a positive list! This is for technical reasons and causes in specific situations that a permission granted in the positive list is removed again by the negative list.
- In the positive lists, read permission is also granted by the execute/write permission. In the negative lists, the execute/write permission is also removed along with the read permission.
- A permission granted through a profile assignment can be revoked by another one. Once a permission has been revoked, it cannot be granted again.
- Profile assignments in a permission list can be removed by marking the entry concerned and pressing Ctrl+D.