Rights Resolution
Explanation
When a user tries to act on a page, XWiki does not read a single setting. It walks the rules that apply to that page and stops at the first one that decides. Knowing that order explains why a right granted in the wiki administration sometimes has no effect on a given page.
The order in which rules are examined
Rules are examined from the most specific level to the least specific one: first the rules set on the page itself, then those set on the space through "Rights: Page & Children", then those set on the wiki. The first level that determines the right decides, so a rule set on a page overrides a rule set on the wiki.
Within one level, a rule that names the user directly beats a rule that matches one of their groups, whether it allows or denies. When several rules of the same kind disagree, the conflict rule of the right settles it, and that rule is not the same for every right: Right Types gives it per right.
Allowing a right denies it to everyone else
At a given level, allowing a right to one user or group denies it to everyone that level does not mention. Granting "View" to one group on a page therefore hides that page from everyone else, without a single denial being set, and this implicit denial is the recommended way to restrict access. It covers only the right actually allowed: the rights that come with another right, such as the "View" implied by "Edit", are never implicitly denied.
An explicit denial works the other way round: it refuses the right to the user or group it names and leaves everyone else inheriting whatever the levels above grant. Denying "View" to one group therefore closes the page to that group alone, which is why allowing the right to the few who need it restricts more reliably than denying it to the many who do not.
The scope chosen when setting the right decides how far the implicit denial reaches. A right set through "Rights: Page" applies to that page alone, so its children keep inheriting the rules of the levels above.
Rights that cannot be overridden
"Admin", "Program" and "Creator" behave differently from the other rights: once one of them is allowed at any level, a denial set on a more specific space or page does not take it away. This is why an administrator of a wiki or of a space keeps their administration rights on every page it contains, together with the rights that "Admin" implies.
When no rule applies
A right that no rule determines falls back to its default value, listed in Right Types. One case does not follow that fallback: a user account defined in another wiki, who is not a global user, is denied everything by default.
Accounts and pages that are treated apart
The superadmin account short-circuits every rights check. The owner of the main wiki always has "Program" right, and the owner of a subwiki always has "Admin" right on that wiki. The creator of a page is always granted the "Creator" right on it, which is what lets an author delete a page they created even though "Delete" is denied by default.
The pages that store the rights configuration, XWiki.XWikiPreferences for a wiki and WebPreferences for a space, are editable by administrators only, whatever the "Edit" rules say. Without that, a user allowed to edit everything could grant themselves any right.
FAQ
Do rights set on a subwiki inherit from the main wiki?
Yes, a subwiki inherits the wiki-level rules of the main wiki, and the defaults of each right apply where there is nothing to inherit.
Why can a user see a page that I denied "View" on for their group?
A rule naming the user directly wins over any rule matching one of their groups, so an allow set on the user overrides the denial set on the group.
