Based on the available documentation, I don't find specific information about changing the OR behavior to AND for RBAC, ReBAC, and ABAC evaluations in Permit.io's check responses. The documentation shows examples of bulk check functionality (1) and discusses how different policy models work (2) (3) (4) , but doesn't explicitly cover configuring the logical operator between different policy model evaluations. For implementing AND logic between different authorization models, you might need to: • Use custom policy code (Rego/Cedar) to define specific conditions • Implement multiple sequential checks in your application logic • Use ABAC with conditions that effectively combine requirements from different models I recommend reaching out to Permit.io support at Email for guidance on your specific use case. Since you're experiencing this with your PDP and policy checks, could you please share: 1. Which Workspace / Project / Env you are using 2. What calls you are performing (as SDK code or CURL) 3. Which PDP version you are running 4. Any relevant logs from your PDP This will help our engineers investigate your specific scenario.

To learn more, see the sources I considered: [[1] Bulk Check](https://docs.permit.io/how-to/enforce-permissions/bulk-check) [[2] Authorization Policy Showdown: RBAC vs. ABAC vs. ReBAC](https://www.permit.io/blog/rbac-vs-abac-vs-rebac) [[3] Role-Based Access Control (RBAC) VS. Relationship-Based Access Control (ReBAC)](https://www.permit.io/blog/rbac-vs-rebac) [[4] Attribute-Based Access Control (ABAC) VS. Relationship-Based Access Control (ReBAC)](https://www.permit.io/blog/abac-vs-rebac)

Yes, that's correct! You can modify the

root.rego

file to change from OR to AND logic between different policy evaluations (1) . By default, Permit.io evaluates policies with an OR operator, where the

root.rego

file contains two separate allow blocks :

allow {
 policies.allow
}

allow {
 custom.allow
}

To change this behavior to AND (where all conditions must be met) , you need to unify the allow section :

allow {
 policies.allow
 custom.allow
}

This modification makes both

policies.allow

and

custom.allow

required for the final authorization decision . The same principle applies when combining RBAC, ABAC, and ReBAC evaluations - you can modify the root policy to require all policy types to return true rather than any one of them . This approach is particularly useful when implementing deny rules or when you need stricter access control that requires multiple authorization models to agree before granting access (1) (2) .

To learn more, see the sources I considered: [[1] Write Custom Policies](https://docs.permit.io/integrations/gitops/custom_policy) [[2] Beyond RBAC: When standard models just aren’t enough](https://www.permit.io/blog/custom-policies)

Thanks for the feedback, glad I was helpful.

Both Resource Sets and User Sets allow for AND or OR based on the logic you create. But for combination RBAC AND ReBAC AND ABAC eval, that's a rego change