Why implementation of node access for different content type breaks my other type access control? System architecture:

Main entities:


Company
Employee (and other user types)
Document


References:


Every document has reference to company and employee.
Every employee has reference to company also (at least one company)


I've implemented custom access control for documents, which suppose to working fine (my unit tests gives me all green also).

Now I'm creating View - documents list for an employee. Basic version of View is working correct. I want to add exposed filter for a company. By default this is a list of all companies. But I want to restrict this list only for companies from employee documents, related to current logged in employee.

Code:

/**
 * Implements hook_node_access_records().
 */
function mymod_company_node_access_records($node) {
  if ($node-&gt;type &lt;&gt; myCompany::CONTENT_TYPE_NAME) {
    return array();
  }

  return array(
    array(
      'realm' =&gt; MYMOD_COMPANY_LOCK_NAME,
      'gid' =&gt; $node-&gt;nid,
      'grant_view' =&gt; 1,
      'grant_update' =&gt; 0,
      'grant_delete' =&gt; 0,
      'priority' =&gt; 0,
    )
  );
}

/**
 * Implements hook_node_grants().
 */
function mymoo_company_node_grants($account, $op) {
  if ($op &lt;&gt; 'view') {
    return array();
  }

  if (mymod_user_is_an_employee($account)) {

    $myUser = myUser::createFromUser($account);
    $companies = $sdUser-&gt;getCompanies();
    if (empty($companies)) {
      return array();
    }

    $grants = array();

    foreach(array_keys($companies) as $nid) {
      $grants[MYMOD_COMPANY_LOCK_NAME][] = $nid;
    }

    return $grants;

  } else {
    return array();
  }
}


Indeed filter list is restricted to employee related companies, but in my View, I'm seeing ALL documents related to these companies. Why?

My View main content type is Document. Company is related node via entity reference field. I don't understand why company access control has some type of precedence here.
While browsing through the Drupal docs about hook_node_access_records, I stumbled upon this comment:


  Note that (as of 7.35) if your module and every other module in your
  installation implementing this hook return empty arrays, Drupal will
  automatically insert a record into the node_access table for the given
  node with GID 0, grant_view set to 1, and grand_update and
  grant_delete set to 0.


You can find it here (last comment).