I need clarification on how access control works.

When enabled, does access control look at both the blacklist and whitelist? Or does it only look at the one that is selected?

Thanks in advance.