Security attributes are resolved in the order they are configured. Here is an example of security attributes:
If a user is excluded from create rights in the second security attribute, but in the last security attribute, the user is granted create rights, the user will have create rights. The last rights granted/excluded are respected.
It is recommended that any values that are configured with the Exclude option be sorted to the bottom of the list of security attributes, unless you explicitly want to grant rights to a user after the excluded security attributes. To order security attributes: