• On an IAccessPermission, the access rights apply to a grantee who is also set on the access permission..
• From IAccessPermissionDescription, the access rights are retrieved to describe the available rights for an object, such as would be found in a security editor.
• On an extended permission of type ICmDelegatedAccessPermission, the access rights for a given object are delegated from one security principal to another, both of whom are specified on the delegated access permission.
• On ICmRoleAccessDefinition, the access rights apply to a class for which access is controlled by the role access definition. The role access definition is set on an instance of ICmRoleClassDefinition, which defines a subclass of ICmRole. The ICmRole object is set on a ICmRolePermission.

  Note: Downlevel applications that unconditionally cast elements to IAccessPermission might encounter a ICmRolePermission object. To accommodate backlevel applications that are unaware of role permissions, the server returns a value of zero for this property.

For an extended permission (ICmExtendedPermission), the getter method for this property returns an access type of ALLOW. This server behavior accommodates backlevel clients that are unaware of extended permissions.

For an extended permission (ICmExtendedPermission), the getter method for this property returns a grantee name of #EXTENDED, plus the symbolic name of the extended permission subclass. For example: #EXTENDED(CmDelegatedAccessPermission). This server behavior accommodates backlevel clients that are unaware of extended permissions.

For an extended permission (ICmExtendedPermission), the getter method for this property returns a grantee type of

UNKNOWN