That’s correct - the key concept is that the access granted by a document is only associated with the active revision of the document. If a new revision no longer issues the access call for a user, that document is no longer granting the user access to the channel.
If 2 different documents result in a user being granted access to a channel. And then one is updated, and doesn’t grant access to that channel. What happens? Is the user implicitly removed from the channel (just like they would be if only one document was in play), or do both documents need to be updated with the removal for the channel access to be revoked?
In general, a user has access to a channel if any document grants access, or if the channel is listed in their admin_channels, or if they inherit access from one of their roles.