In this illustration, since Subject 2 (Group 2) is the Pool Operator and User 1 is a member

of Group 2, when Subject 3 (User 1) tries to log in, he or she inherits both Subject 3 (VM Operator) and Group 2 (Pool Operator) roles. Since the Pool Operator role is higher, the resulting role for Subject 3 (User 1) is Pool Operator and not VM Operator.

21

Page 39
Image 39
Citrix Systems 6 manual