This statement about configuring application access is true. An access group is a rule that defines the roles and permissions that users have in an application. An access group can list more than one role, but the system uses the most restrictive setting when there is a conflict between roles. For example, if one role allows creating a case and another role denies creating a case, the system denies creating a case for users who belong to both roles. References: https://community.pega.com/knowledgebase/articles/security/86/access-groups