"The sequence is ROLES first, then condition, then script." - Chuck Tomasi says so at this link: https://www.servicenow.com/community/grc-forum/order-of-execution-of-an-acl/m-p/1311962/highlight/true#M6538

The Allow configuration Application Access option determines whether users can configure the application tables, such as adding or modifying fields, views, or indexes. The following is true for a table with the Allow configuration option selected:
* Out of scope applications can create Business Rules for the table. This is true because the Allow configuration option grants access to the table configuration to any user who has the admin or personalize_dictionary role, regardless of the application scope. This means that users can create Business Rules, which are server-side scripts that run when a record is displayed, inserted, updated, or deleted, for the table from any application.
The following are not true for a table with the Allow configuration option selected:
* Only the in scope application's scripts can create Business Rules for the table. This is false because the Allow configuration option does not restrict the creation of Business Rules to the in scope application, as explained above.
* Any user with the application's user role can modify the application's scripts. This is false because the Allow configuration option does not grant access to the application scripts, such as client scripts or script includes, to any user who has the application's user role. To modify the application scripts, users need to have the admin role or the application's admin role.
* Out of scope applications can add new tables to the scoped application. This is false because the Allow configuration option does not allow out of scope applications to add new tables to the scoped application. To add new tables to a scoped application, users need to have the admin role or the application's admin role and be in the application scope. References: Application Access, Business Rules Reference: https://community.servicenow.com/community? id=community_QUESTION NO:
&sys_id=1a721819dbfa23409a64e15b8a9619d2

Explanation/Reference: https://docs.servicenow.com/bundle/orlando-platform-user-interface/page/administer/navigation- and-ui/task/t_CreateAnApplicationMenu.html

https://docs.servicenow.com/bundle/tokyo-platform-security/page/administer/contextual-security/concept
/access-control-rules.html

The following is true for GlideUser (g_user) methods:
* Can be used in Client Scripts, UI Policies, and UI Actions. This is true because GlideUser (g_user) methods are part of the client-side scripting APIs that provide information about the current user and the user's preferences. Client Scripts, UI Policies, and UI Actions are all types of client-side scripts that run in the web browser and manipulate the user interface.
The following are not true for GlideUser (g_user) methods:
* Can be used in Client Scripts and UI Policies only. This is false because GlideUser (g_user) methods can also be used in UI Actions, which are another type of client-side scripts that can be triggered by a user's click on a button, link, or choice.
* Can be used in Business Rules only. This is false because GlideUser (g_user) methods cannot be used in Business Rules, which are server-side scripts that run on the ServiceNow platform and manipulate the database. Business Rules use a different API to access the current user information, which is GlideSystem (gs).
* Can be used in Business Rules, and Scripts Includes. This is false because GlideUser (g_user) methods cannot be used in Business Rules or Script Includes, which are both server-side scripts. Script Includes are reusable units of code that can be called from any server-side script. Script Includes also use GlideSystem (gs) to access the current user information. References: Client-Side Scripting APIs, GlideUser, Business Rules, Script Includes Reference: https://developer.servicenow.com/dev.do#!/reference/api/newyork/client/c_GlideUserAPI