+
+ Global rules (non group-specific) are restrictions, and cannot be bypassed.
+ Group-specific rules grant additional permissions, but are constrained within the bounds of global ones.
+ The first group rules restrict further the global rules, but can be relaxed by additional group rules.
+
+
+ Detailed algorithm:
+
+ - Global rules are combined together with a logical AND operator, and with the result of the following steps
+ - Group-specific rules are combined together with a logical OR operator
+ - If user belongs to several groups, the results from step 2 are combined with logical OR operator
+
+
+
Example: GLOBAL_RULE_1 AND GLOBAL_RULE_2 AND ( (GROUP_A_RULE_1 OR GROUP_A_RULE_2) OR (GROUP_B_RULE_1 OR GROUP_B_RULE_2) )
+
+