Quick question because I can't find the answer anywhere without trial and error, which we all hate...

If a user is authorized and a member of a security role, and a module has permissions to the authorized group will that user have access by default? or does the role have to have access?

If a user belongs to several security roles is there any order of inheritance or are all equal?? if module allows one of his roles, will he have access?

thanks!