Alfresco groups hierarchy/permissions

[lista]

Can someone explain to me, or point me in the right direction (documentation), why group hierarchy works like it works.
To be more precise, if I have a:

- group called TOP LEVEL
- one group called GROUP ONE under TOP LEVEL
- one group called GROUP TWO under TOP LEVEL

when applying permissions to a node, the following is true:

- take a node, add permissions to TOP LEVEL group, people in sub-groups also see it (so downwards hierarchy)
- take a node, add permissions to GROUP ONE, people in TOP LEVEL and GROUP TWO also see it (so, upwards, downwards, hell all kind of hierarchy going on here)

The second behavior is totally unexpected from my point of view and renders hierarchy totally useless, this is like admin permissions to everyone.

[afaust]

Hello,

the second behavior is not supposed to occur (and does not occur in all versions I've used so far) when there is no overlap of memberships, i.e. a user from top level / group two is NOT included in group one as well.

What kind of permission are you setting / testing? What are the ACL settings before you change it (including inherited permissions / permissions for pseudo group EVERYONE)?

Regards
Axel