When a record rule is not assigned to any security group, it is marked as global and is handled differently from the other rules.

Global record rules have a stronger effect than group-level record rules, and set access restrictions that those can't override. Technically, they are joined with an AND operator. In standard modules, they are used to implement multi-company security access so that each user can see only their company's data.

In summary, regular non-global record rules are joined together with an OR operator; they are added together and a record is accessible if any of the rules grant that access. Global record rules then add restrictions to the access given by regular record rules, using an AND operator. Restrictions added by global record rules can't be overridden by regular record rules.