Aspnetcore: ًWhat if i used both Authorized[policy] and Authorized[role] above my controller?

It depends which version and what compability mode actually. The intention was that policies would always combine as an AND.

However, this was incorrect, and would combine as an OR in ASP.NET Core 1.0, 1.1, and 2.0.

We discovered the problem in 2.1, but because it's a breaking change of behaviour, it is tied to a compatibility switch in 2.1 and 2.2.

In 3.0 multiple policies always combine as an AND.

Thanks for your responses, but when will the new version(3.0) be released?

There are previews available now - https://dotnet.microsoft.com/download/dotnet-core/3.0

I don't have an official release date to share yet.