# Shield document and field level security
**URL:** https://discuss.elastic.co/t/shield-document-and-field-level-security/87042
**Category:** Elasticsearch
**Created:** [May 24, 2017, 8:34pm UTC](https://discuss.elastic.co/t/shield-document-and-field-level-security/87042 "2017-05-24T20:34:54Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sminogue](https://discuss.elastic.co/u/sminogue)
#### Post date: [May 24, 2017, 8:34pm UTC](https://discuss.elastic.co/t/shield-document-and-field-level-security/87042/1 "2017-05-24T20:34:54Z")
So I have a somewhat unusual use case that I am wondering if ES Security can handle.
I have documents indexed into my ES cluster and I want to set up security such that:
A) Documents and Fields are searched even if the user doesn't have access to a document. Basically if the user searches for "water" and we have a document about water which they are not allowed access to. I want to show the search result so they can request access to the document.
Also, it wasn't clear to me from the documentation how the roles stack. So I want a field to require:
(ROLE\_A AND ROLE\_B) OR ROLE\_C does xpack security support that?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [May 24, 2017, 9:29pm UTC](https://discuss.elastic.co/t/shield-document-and-field-level-security/87042/2 "2017-05-24T21:29:56Z")
> [@](#):
>
> if the user searches for "water" and we have a document about water which they are not allowed access to. I want to show the search result so they can request access to the document.
X-Pack security doesn't provide that feature.
Document Level Security is specifically designed to hide documents that the user cannot access. They will always be excluded search results.
For what you're after, you'd need to do something within your own application.
> [@](#):
>
> Also, it wasn't clear to me from the documentation how the roles stack. So I want a field to require:
> (ROLE\_A AND ROLE\_B) OR ROLE\_C does xpack security support that?
Roles stack additively with respect to permissions.
Because the model is that _roles have access to fields_ (rather than _fields are restricted to roles_), a user has access to a field if any of their roles grant them access to that field.
So "ROLE\_A or ROLE\_C" is totally possible - because you simply enable that field in each of those roles.
But "ROLE\_A and ROLE\_B" is not possible - there's no way to express dependencies between 2 roles.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 21, 2017, 9:29pm UTC](https://discuss.elastic.co/t/shield-document-and-field-level-security/87042/3 "2017-06-21T21:29:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.