From 575a7fb88b54b249087d07a377058ee406ef7b65 Mon Sep 17 00:00:00 2001 From: Alexis Delahaye Date: Mon, 17 Aug 2026 17:42:56 +0200 Subject: [PATCH 1/2] add precision about ACL groups intersection --- .../configuration/access-conditions/index.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/deploy-and-configure/configuration/access-conditions/index.md b/docs/deploy-and-configure/configuration/access-conditions/index.md index 865c5605..84117d87 100644 --- a/docs/deploy-and-configure/configuration/access-conditions/index.md +++ b/docs/deploy-and-configure/configuration/access-conditions/index.md @@ -57,6 +57,14 @@ PREFIX : Since both user and group resource are represented in the same namespace in the internal graph representation, users and groups cannot have the same identifier. +!!! warning "Requirements combine as a logical AND" + + All requirements of a single access condition must be met at once. + In particular, **Requires group** is evaluated as a conjunction: if you list several groups, the account must be a member of *every* one of them, not just one. + Combining **Requires account** with **Requires group** even narrows the access further. + + To grant access to several audiences, create **one access condition per audience** or use [Dynamic Access Conditions](#dynamic-conditions). + ### Define **what** grants are given - **Allow reading graph** is a list of graph IRI to allow to read these graphs. From 11406b22967a31694108069077e50cc6d099f3d0 Mon Sep 17 00:00:00 2001 From: Rene Pietzsch Date: Tue, 18 Aug 2026 09:01:46 +0200 Subject: [PATCH 2/2] clarify ACL group intersection wording --- .../configuration/access-conditions/index.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/deploy-and-configure/configuration/access-conditions/index.md b/docs/deploy-and-configure/configuration/access-conditions/index.md index 84117d87..12b9f3ab 100644 --- a/docs/deploy-and-configure/configuration/access-conditions/index.md +++ b/docs/deploy-and-configure/configuration/access-conditions/index.md @@ -57,13 +57,15 @@ PREFIX : Since both user and group resource are represented in the same namespace in the internal graph representation, users and groups cannot have the same identifier. -!!! warning "Requirements combine as a logical AND" +!!! warning "All requirements in an access condition must be met" - All requirements of a single access condition must be met at once. - In particular, **Requires group** is evaluated as a conjunction: if you list several groups, the account must be a member of *every* one of them, not just one. - Combining **Requires account** with **Requires group** even narrows the access further. + Multiple **Requires group** values are combined with AND: the account must be a member of **every** listed group. - To grant access to several audiences, create **one access condition per audience** or use [Dynamic Access Conditions](#dynamic-conditions). + Combining **Requires account** and **Requires group** further restricts access. + + To grant access to different audiences, create **one access condition per audience** or use [Dynamic Access Conditions](#dynamic-conditions). + + For example, to grant access to members of either `group-a` **or** `group-b`, create two access conditions. Adding both groups to a single access condition would require the account to be a member of **both** groups. ### Define **what** grants are given