An object has inherited permissions from two parent objects. What is true about the permissions on the object?

Applying only the intersection of common permissions would be overly restrictive and would silently drop access rights granted by one parent but not the other, which is not how standard permission inheritance operates.

Standard permission inheritance uses an additive model - when multiple parents grant permissions to a child object, all permissions from every parent are merged together into the effective permission set on the child. This ensures that any right explicitly granted by any parent is preserved rather than lost, making access control both predictable and consistent. The resulting effective permissions represent the broadest set of rights across all inheritance sources.

Inherited permissions are applied by design unless inheritance is explicitly blocked at the object level - ignoring all parent permissions would defeat the purpose of hierarchical access control.

Permission systems are deterministic and must produce consistent results - randomly selecting from one parent's permissions would make security enforcement unpredictable and unauditable.