# Shield document level security role hierarchy

**URL:** <https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [December 6, 2015, 10:43am UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460 "2015-12-06T10:43:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![avibh](https://avatars.discourse-cdn.com/v4/letter/a/9fc29f/32.png) [@avibh](https://discuss.elastic.co/u/avibh)\
**Post date:** [December 6, 2015, 10:43am UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460/1 "2015-12-06T10:43:12Z")

</div>

Hi,

prerequisites - I have a "global" index which contains data from different sources. this is the baseline for my question.  
I want to add shield security to this "global" index so different users will get the data they are allowed to.  
if I create a role per permission as described bellow, will a user with both permission benefit from both roles.  
meaning does shield know to merge all role based query permission so the user get all the valid data?

here's my example  
a user with role "role1" & "role2" will get data with [department\_id: 1 or department\_id: 2] ?

role1:  
indices:  
'global':  
privileges: read  
query:  
term:  
department\_id: 1  
role2:  
indices:  
'global':  
privileges: read  
query:  
term:  
department\_id: 2

updated: it seems that shield is doing an "and" operation between the roles, can it be the case?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 6, 2015, 9:39pm UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460/2 "2015-12-06T21:39:04Z")

</div>

> [@avibh](#):
>
> meaning does shield know to merge all role based query permission so the user get all the valid data?

Yes, it merges the roles.

---

<div class="post-metadata">

**Author:** ![avibh](https://avatars.discourse-cdn.com/v4/letter/a/9fc29f/32.png) [@avibh](https://discuss.elastic.co/u/avibh)\
**Post date:** [December 7, 2015, 7:27am UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460/3 "2015-12-07T07:27:05Z")

</div>

but how, does it do an "or" or an "and" between roles?  
from my tests it does an "and" which doesnt make sense when it comes to roles as group in AD

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 7, 2015, 11:04am UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460/4 "2015-12-07T11:04:24Z")

</div>

You are correct. It is currently doing an `AND` on the queries. We're thinking about changing this to an `OR` in the future.

---

<div class="post-metadata">

**Author:** ![avibh](https://avatars.discourse-cdn.com/v4/letter/a/9fc29f/32.png) [@avibh](https://discuss.elastic.co/u/avibh)\
**Post date:** [December 7, 2015, 2:28pm UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460/5 "2015-12-07T14:28:24Z")

</div>

is it a planned feature?  
I'm asking cause currently I cant use shield, but would like to prevent from developing it on my end if it is going to be supported by shield 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/shield-document-level-security-role-hierarchy/36460/6 "2017-07-06T13:47:34Z")

</div>