ACL on parent and child table work

[Kohei4]

Hi

Please let me confirm how acl rules work configured on parent and child tables.

There is a create acl rule (A) on the parent table which requires 'parent table user role' and there is another rule (B) on the child one which requires 'child table user role'.

When a user with the parent table user role and without it for child table try to create records on the Child table, user cannot do that because the acl rule B deny the access to child table. Is my understanding right?

Now I am troubleshooting the issue that a user with import_admin role can create records on a table extended from sys_import_set_row table that should not be accessed.

I wonder if import_admin can override any acls for all tables extended from the sys_import_set_table...

The reason the user has the import_admin role is than the user need to import excel file for other tables on another application.

[Mandeep Karan · Accepted solution]

When a user with the parent table user role and without it for child table try to create records on the Child table, user cannot do that because the acl rule B deny the access to child table. Is my understanding right? --> Yes your understanding is correct. 

if ACL on child table is defined then parent ACL will be masked with child's one and all priority will be given to child's ACL.

You can refer the below image for sequence of evaluation:

[Kohei4]

Thank you for your comment.

Umm.. I cannot understand why the user could create records on the child table...

I have already confirmed that by creating test user with the same roles and he cannot access to the child table in dev instance.

Do you have any good idea to troubleshoot this issue?

[Mandeep Karan]

Can you share the ACLs created on extended table?

[Mandeep Karan]

Or can you confirm if you have created ACL for create permission at none level.