Does changing permissions to a certain role affect other roles?

Question

I have a role, "Role1", - a member of "RoleA". Also, I have created a new role, "Role2", which is also a member of "RoleA".

Now, I want to change the permissions in workflows and templates of Role2. So I run the script that I have created.

Workflow

$allowWSWrite = New-ItemAcl -AccessRight workflowState:write -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"
$allowWSDelete = New-ItemAcl -AccessRight workflowState:delete  -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"
$allowWCExecute = New-ItemAcl -AccessRight workflowCommand:execute -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"

Get-Item -Path "master:system/Workflows" | Set-ItemAcl -AccessRules  $allowWSWrite, $allowWSDelete, $allowWCExecute

Templates

$allowRead = New-ItemAcl -AccessRight item:read -PropagationType Any -SecurityPermission AllowAccess -Identity "Role2"
$denyDelete = New-ItemAcl -AccessRight item:delete -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"
$denyWrite = New-ItemAcl -AccessRight item:write -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"
$denyRename = New-ItemAcl -AccessRight item:rename -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"
$denyCreate = New-ItemAcl -AccessRight item:create -PropagationType Any -SecurityPermission DenyAccess -Identity "Role2"

Get-Item -Path "master:sitecore/templates" | Set-ItemAcl -AccessRules $allowRead, $denyDelete, $denyWrite, $denyRename, $denyCreate

Upon checking, Role1 cannot create/edit a page which it previously could.

Does it has something to do with the permissions I have changed in Role2? Please advise.

Answer 1

Yes, it does.

When you use Set-ItemAcl you overwrite all the security settings which were assigned to that previously.

When you set new access rights for Role2 you removed everything what was set there for Role before.

If you want to add some access rights instead of overwriting everything, try using Add-ItemAcl instead:

Get-Item -Path "master:sitecore/templates" | Add-ItemAcl -AccessRules $allowRead, $denyDelete, $denyWrite, $denyRename, $denyCreate