The statements that must evaluate to true for a user to pass an Access Control are:
Conditions configured in the Access Control must evaluate to true.
The user has one of the roles specified in the Required roles related list.
Scripts configured in the Access Control must evaluate to true.
An Access Control is a rule that determines whether a user can access a particular object or operation in ServiceNow. An Access Control consists of three elements: Conditions, Roles, and Script. Each element specifies a requirement that the user must meet to access the object or operation. If any of these elements return false, the Access Control denies access and stops evaluating the remaining elements. Therefore, for a user to pass an Access Control, all three elements must evaluate to true.
The other statements are not required for a user to pass an Access Control. Other matching Access Controls for the records do not need to evaluate to true, as only one matching Access Control needs to return true for access to be granted. The user does not need to be granted access through a business rule, as business rules are not part of Access Controls and do not affect their evaluation. Reference: Access control rules, Access Controls