MENU
Which order of precedence applies if a user is a member of multiple groups and the level of access is not the same?
According to IBM Instana documentation, access rights for users belonging to multiple groups are resolved by applying the most restrictive role. The documentation states: 'If a user belongs to more than one group, the permissions are set according to the order: No access > Limited access > Access all. If there's a conflict, 'No access' always takes precedence, followed by 'Limited access,' then 'Access all.'' This ensures that users do not gain unintended permissions due to overlapping group assignments and supports the principle of least privilege. This behavior is critical for security compliance and consistent access control, especially in regulated environments or where different teams have varying visibility requirements. By enforcing the strictest restriction, Instana reduces risk from misconfigurations and accidental escalation of privilege, and helps satisfy audit trail and governance requirements in enterprise use cases.