I need some URGENT help with implementing user/group-style permission on a site. I'm hoping someone will be monitoring the forum over the weekend, because I need to have this implemented by Monday, and I've been fiddling for a whole day with just about every combination of groups/users/permissions, and so far I can't get it to work properly. It's a fairly common security matrix, so I'm sure it's simple and I'm just missing something important.

I'm using Workflow, and there are various users who are to be given read/write access to specific sections of the site. (Everyone should be able to read and unfold the tree, but only Admins or the Section Editor should be able to edit content of specific sections)

I have a group created called "Site Editor", which has Read and Unfold permission only on CMS Content.

The site has various sections, which are to have specific "Site Editors". These site editors should have the additional permissions of Check in any Document, Create, Delete and Modify, BUT, they should have these permissions ONLY for the section of the site that they are granted permission for. So I created the following groups, and set permission for CMS Content in the Permissions matrix:

1. "Site Editor" -- Read, Unfold
2. "Training Editor" -- Check in any Document, Create, Delete, Modify

Then I created two users:

i) "trainingtest" -- assigned to the groups Site Editors and Training Editor
ii) "othertest" -- assigned to only the group Site Editors

Then on the Content tab, at the Root level, I set Page Permissions as follows:

======================================================================
A.

Site Editors group -- Allow=Read,Unfold; Deny=everything else

Added Training Editor group -- Deny=all (trainingtest user should get Read/Unfold permission from membership of the Site Editors group)
Deny overrides Allow, therefore logging in as "trainingtest" wasn't able to unfold tree
Modified Training Editor group - Allow=Read,Unfold; Deny=everything else
"trainingtest" can unfold all leaves of the tree
======================================================================

B. The Home page (and section under Home) inherits permissions from parent, and I didn't modify this at all (therefore, all permissions as above)

======================================================================
C. Training section -- this is the only section that the "trainingtest" user should have access to check a document out and edit. On this section I set permissions as:

Site Editors group -- Allow=Read,Unfold tree; Deny=everything else (inherited from Root)
Training Editor Group -- Allow=Read,Modify,Create,Delete,Unfold; Deny=everything else
======================================================================

BUT .....

The user "trainingtest" can check out, edit, and save/check in a document at ANY LEAF OF THE TREE!!!! I've tried every combination of permissions I can come up with, and it seems I've only got an all-or-nothing scenario -- trainingtest has write access to everything or nothing at all!!!

The global permission set for CMS Content in Permissions seems to be overriding the local page permission, which is to DENY write access to the Training Editor group for anything other than the Training section.

URGENT PLEASE -- how can I implement this??

Thanks,
Sharon.