title: .Net core Authorize attribute inheritance of roles from global to controller
body: <p>As I understand, there are 3 'levels' that I can use the authorise attribute with roles in my web application. The first would be global auth policy for the webapp, like the following:</p>
  <pre><code>serviceCollection.AddMvcCore(options =&gt;
              {
                  options.Filters.Add(new AuthorizeFilter(&quot;MyPolicy&quot;));
              })
              .AddAuthorization(options =&gt;
              {
                  options.AddPolicy(&quot;MyPolicy&quot;, builder =&gt;
                  {
                      builder.RequireAuthenticatedUser();
                      builder.RequireRole(new[]{&quot;MyRole1&quot;,&quot;MyRole2&quot;});
                  });
              });
  </code></pre>
  <p>This would mean that only logged in users with MyRole1 or MyRole2 could use the webapp.</p>
  <p>The next two levels would be using an authorisation attribute at the controller level and then at the endpoint level as shown here:</p>
  <pre><code>[Authorize(Roles = &quot;MyRole3,MyRole4&quot;)]
  public class MyController : Controller
  {
      public MyController(){}
  
      [HttpGet]
      [Authorize(Roles = &quot;MyRole5,MyRole6&quot;)]
      public async Task&lt;IActionResult&gt; Get()
      {
          var result = &quot;something&quot;;
          return this.OkOrBadRequest(result);
      }
    }
  </code></pre>
  <p>In this case which roles apply to the endpoint? Are all the roles ORed together all the way down, are all the roles ANDed together all the way down, or is it the case of &quot;most specific first&quot;?</p>
  <p>In the case of ORing together all the way down this would mean that any role from MyRole1 to MyRole6 could access the Get endpoint here.</p>
  <p>In the case of ANDing together all the way down this would mean that a user needs
  (MyRole1 OR MyRole2) AND (MyRole3 OR MyRole4) AND (MyRole5 OR MyRole6) to access the Get endpoint here.</p>
  <p>In the case of &quot;most specific first&quot; it would mean that only MyRole5 or MyRole6 could access the endpoint and roles at all other levels are ignored.</p>
  <p>What would I do if I want to add an AND at a particular level, for example on MyController I want it to be (MyRole3 || MyRole4) &amp;&amp; MyRole7?</p>