Hi David,

Here is how cumulative permissions work respective to capabilities and menu editor.

Capabilities work using OR relationship. For example if a user has primary Role A and secondary Role B, that user will have capability ABC, if either Role A or Role B has capability ABC.

While menus work using AND relationship. For a menu to be enabled, user should have the capability used my the menu and that menu should be enabled for all roles(Role A and Role B) within the menu editor. You can exclude checks on secondary roles, by enabling “Disable for Secondary Role” option available in the menu editor.

Hope this information helps.

Thanks

Syam