There are multiple ways that an administrator can be assigned a right:
A right is assigned directly to the administrator’s account
A right is assigned to an administrator group in which the administrator is a member
A right is included in an administrator role that is assigned to the administrator or to an administrator group in which the administrator is a member
In some cases, rights assignments might conflict. When assignments conflict, the most restrictive setting is enforced. For example, an administrator might be assigned the same bundle right through his or her administrator account and through a role. If the settings are different in the two assignments (for example, one setting is Allow and the other is Deny), the setting is used because it is more restrictive than .