I am struggling with an issue in refining the Coveo search results in a Sitecore 9.3 solution. The problem I am facing is that there are specific items, that I can access just fine in the live websites, but Coveo does not return those in the result set, because of the way permissions are handled.

Now, I am not saying that the problem is on the Coveo side, but I am trying to figure out what might be wrong with our solution.

The scenario is the following:

  1. We have a page on our website called Page 1 for example
  2. We set the permissions for that page to be as follows: Role 1 - allow, Role 2 - allow, Role 3 - deny (in the inheritance section).
  3. Role 1 and Role 2 are members of Role 3, as set in Sitecore (all of our roles are set up like this).
  4. The way it works for us is that it denies access to all users that have the Role 3 assigned, except for the ones that have ones of the roles Role 1 / Role 2 (so it's sort of like we deny everyone until a specific role that allows access)

Initially, I thought that maybe we have some processor that would handle this behavior in a different way, but I could not find any.

I understand that Deny overrules Allow, but I was wondering what is the behavior that should be when the Allowed roles are actually members of the Deny role.

Could anyone help with at least a suggestion? Thanks.

1 Answer 1


Alright, it seems that the actual problem was the fact that Role 3 was also assigned to the logged in user (as an individual role), so in this case the inheritance breaking was not working. That is how the solution was implemented from the beginning, but only now it started to actually hit us in the face.

After removing Role 3 from the logged in users, everything was fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.