Not always a checkbox but always the same presentation mismatch - ‘Default security’ in Kinetic. In Classic, the ‘dis/allow access to all groups/users’ checkboxes.
Those values are represented by an asterisk ‘*’ in a comma delimited field, either ICE.Security.EntryList or ICE.Security.NoEntryList.
PSA #2: never use a comma or asterisk or unicode analog of either in any userID or security group ID.