Drupal 8 access check system uses 3VL as well: Allowed, Forbidden, Neutral. What I found interesting is the only difference between AND / OR is the Allowed - Ne

Drupal 8 access check system uses 3VL as well: Allowed, Forbidden, Neutral. What I found interesting is the only difference between AND / OR is the Allowed - Neutral case: OR resolves that as Allowed while AND resolves that as Neutral. Otherwise, X AND/OR X is obviously X and F AND/OR X is F. Sounds quite logical but the truth table does look weird with so little difference. In other words, at the end of the day, when making a decision to deny or grant access using a bunch of these 3VL checkers, you use two rules: 1. If anyone forbid, then it's a deny. 2. If no one forbid, if running OR then you need at least one Allowed when running AND then you need to have all of them saying Allowed.