If I create a custom role and add some restrictions of different types (for example - employee, department, location) - Will the access be evaluated based as logical AND or logical OR? For example: • if we have the "Cool Manager" role with the "View Employee" permission and the following restrictions: ◦ department=Engineering ◦ location=UK ◦ subsidiary=MySubCompany Will it be evaluated as "Can view all employees except MySubCompany's engineering employees located in UK" or "Can view all employees except employees from MySubCompany or UK based employees or engineers"? Is there any way to control whether the evaluation is AND/OR?