Visibility priority for service subscribers

[HHH]

I'm having trouble with regards to the computed visibility of/access to catalogue items.
For example, we have User A in Team A on Site A
If I set User A enabled and Team A disabled, User A will have access to the CI.
If I set Team A enabled and Site A disabled, User A will not have access to the CI.

Is there a definite list of access overrides somewhere? I.E. Site trumps Company, User trumps Team, etc.
I hope I make sense but our organisation structure is quite complex and it would help a lot clearing things up and allowing the proper people access to the CI's.