[opencms-dev] How do user permissions work

[Barry]

Hi,

Is there a description somewhere of exactly how user/group permissions 
work? I'd like to be able to set up a user who has permissions to do 
everything within a certain directory within the VFS but cannot do 
anything in (and cannot even detect the presence of) directories above 
or outside this directory. Any ideas on how this can be done?

So far, I've created the user and given them a new group and have given 
this new group read permissions only on /sites, /system and /channels 
and then given the group all permissions on the directory I want them to 
see. However, they can see the files in the group but do not get 
permissons to change or publish them.

Regards, Barry.