Security

I am in the process of setting user based rules on my contoller.  I am a K12.  When I give the Staff users access to a server my rules reads as this:

User to server/IP  permit

server/IP to user  permit

Do I need to have it flow both ways or can I just give the user the "permit" action to the server/IP?

Just the first rule.  The rules are stateful, so a rule allowed in one direction will allow a flow from an existing session to return.