---
title: "How do I Combine Multiple Trustee Filters?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/how-do-i-combine-multiple-trustee-filters"
language: "en"
last_updated: "2026-05-19T19:51:04.687Z"
---

# How do I Combine Multiple Trustee Filters?

Combining multiple trustee filters in a conditional Tag enables you to catch different naming conventions (like "Everyone" vs. "Authenticated Users") while still ensuring the data is actually sensitive and the access is allowed.

To combine multiple **ACL: Trustee** filters effectively, you must use a combination of **Grouped Logic** (using parentheses) and **OR/AND** operators.

-   This enables you to catch different naming conventions (like "Everyone" vs. "Authenticated Users") while still ensuring the data is actually sensitive and the access is allowed.
-   In the Spirion **Tag Management** interface, you achieve this by adding multiple rows and carefully selecting the logic between them.

## **The "Best Practice" Structure**

When combining trustees, you are usually trying to find **any** of several high-risk groups. Therefore, you use **OR** logic between the different trustees, but **AND** logic for the rest of the requirements.

### **Example: The "Broad Access" Tag**

This conditional Tag catches any file that is open to the entire company OR the general public.

| Row | Logic | Field | Operator | Value |
| --- | --- | --- | --- | --- |
| **1** |  | **ACL: Trustee** | **Contains** | `Everyone` |
| **2** | **OR** | **ACL: Trustee** | **Contains** | `Authenticated Users` |
| **3** | **OR** | **ACL: Trustee** | **Contains** | `Domain Users` |
| **4** | **AND** | **ACL: Ace Type** | **Equals** | `Access Allowed` |
| **5** | **AND** | **Unprotected Quantity** | **Greater Than** | `0` |

* * *

## **Key Rules for Combining Trustees**

### **1\. Use "OR" for Variations of the Same Concept**

If you are looking for "Contractors," they might be called "Contractors," "Vendors," or "External." Link these with **OR** because a file only needs to have *one* of these groups to be a risk.

-   **Example**: `Trustee Contains Contractor` **OR** `Trustee Contains External`

### **2\. Use "AND" to Narrow the Risk**

Once you have identified the "Who" (the Trustees), you must use **AND** to ensure the "How" (Ace Type) and "What" (Quantity) are also true.

-   **IMPORTANT!** If you use **OR** for the `Ace Type`, you get thousands of "False Positives" because the rule triggers if *either* the trustee is a contractor *or* if *any* file anywhere has "Access Allowed."

### **3\. Mind the "Order of Operations"**

In the Spirion UI, the logic typically flows from top to bottom.

-   **Top Section:** List all your Trustees linked by **OR**.
-   **Bottom Section:** List your verification filters (Ace Type, Quantity, Authorization) linked by **AND**.

* * *

## **Advanced Example: The "Ransomware Risk" Combo**

This identifies if any high-risk group has the power to **change** or **delete** sensitive data.

-   **(ACL: Trustee Contains** `Everyone`
-   -   **OR ACL: Trustee Contains** `Authenticated Users`
    -   **OR ACL: Trustee Contains** `Guest`)
-   **AND (ACL: Ace Type Equals** `Access Allowed`)
-   **AND (ACL: Authorization Contains** `Full Control` OR ACL: Authorization Contains `Modify`)
-   **AND (Unprotected Quantity > 0)**

* * *

## **Troubleshooting Tip: The "Logic Trap"**

The most common mistake is setting the logic to:  
`Trustee Contains Everyone` **AND** `Trustee Contains Authenticated Users`.

**Why this fails:** A single permission entry (ACE) usually only has **one** trustee. If you use **AND**, you are telling Spirion: *"Find me a single permission entry that is simultaneously 'Everyone' and 'Authenticated Users' at the same time."* This almost always returns **zero results**.

> Always use **OR** when listing multiple groups/trustees.

## **Summary of Logic**

-   **Multiple Trustees?** Use the **OR** operator.
-   **Verifying the Access?** Use the **AND** operator.
-   **Confirming the Data?** Use the **AND** operator.