@Ankit Kumar6 If multiple ACLs are defined on the same object (Table/Field) only one of them needs to evaluate to true to grant access to that object.
Equate this to an OR operation where the condition becomes true if one of the operands evaluates to true. This behaviour is by design and allows greater flexibility.
Consider an example of a field level ACL for phone number field on sys_user table, there are two ACLs defined one checks the role and the other one checks role + script. Instance will evaluate these ACLs and only evaluate upto a point till one of them evaluates to true and grant access. Had ServiceNow made it compulsory to evaluate both ACLs to true to grant access only a handful of users with superior access would have gotten access rest would have failed to gain access as not all ACLs evaluated true for them.
