In the older CFS, as long as one of the ratings is forbidden, then the connection will be blocked.
In CFS 4.0 (since SonicOS 6.2.5 and SonicOS 22.214.171.124 for SM9800's), the case is different. There are added features. Not only can you use CFs to allow and block websites, but also confirm and passphrase. So the priority of each operation needs to be defined.
In CFS 4.0, the priority of the Content Filtering actions are listed as below:
For example, one domain example.com has the ratings: 1, 2, 3 and 4. User defines the operations:
1 -> Allow 2 -> Block 3 -> Confirm 4 -> BWM
Then when users access example.com, CFS will check whether its ratings are belonged to "Block" categories first, then check "Confirm" categories, and then check "BWM" categories. If none of them is hit from the above checking, then it will be allowed.