Role Usage

As a practice, is it more appropriate to add a policy whether user or resource to either the source or destination object. Are there best practices in this regard?
What occurs if both a user and resource policy exist. Which has priority?