Combining Multiple Sources in a Rule (Boolean logic)
If a private access rule includes multiple sources, the following boolean logic applies:
Secure Access combines all types of sources and all sources within a type using the boolean OR operator. Traffic to each source that you specify in a rule matches the rule. For example, if you specify a user group and a network tunnel group as sources, traffic from any member of either group matches the rule.