You can see here that:

• 1. The Role evaluation is done first: One or more user roles to the Requires role
• 2. Then one or more conditions.
• 3. And finally, a script that evaluates to true or false or sets the answer variable to true or false.

The evaluation order looks like this (image from the Docs with added numbers):

Knowing this evaluation order gives us the chance to create more efficient ACLs. Thinking of some of the tables and all the records in it, these ACLs evaluate many times, so any efficiency we can achieve multiplies 1000-fold.

Setting up the required roles in such a way that it makes sure only the right roles/people have access, or continue to the next evaluation (the Condition check). People that do not have the right Role will not be granted access; the additional checks will not need to run:

If you compare this to a less clearly defined Roles condition, where only the condition or Script determine the access, that needs to evaluate a bit more:

Note: Although in the title it is called a BESS PRACTISS, it only means it is good to know it’s principle and understand the reasoning. If for any reason deviating from this better fits the purpose, then always do that.

If you have any of your own BESS PRACTISUSS please add/share in the comments.

© BESS PRACTISS and BESS PRACTISUSS are trademarked and belong to @Robert Fedoruk