Ah, "NodePermissionsEnum" is your friend.

Hi Michael,

Your assumption with bit mapping is correct.
You could find the SetUserPermissions method specification in the API reference, available in your Kentico installation or downloadable from http://devnet.kentico.com/downloads/kenticocms_api.zip

It is defined as:
public virtual void SetUserPermissions(TreeNode node, int allowed, int denied, UserInfo userInfo)

In the API reference, which is besides the DevGuide the only documentation about API, there is unfortunatelly not everything you might want to know, so I'll try to explain:

'allowed' and 'denied' variables (Int32) hold permission flags for
every permission in one bit. The permissions are checked using binary shifting and modulo:

allowed >> Convert.ToInt32(permission)) % 2 == 1
(the same for 'denied')

permission – NodePermissionEnum - is enumeration which integer
value represents position of the bit holding the permission settings
The enumeration is described in the API reference.
Permission bits are:
0 - Read
1 - Modify
2 - Create
3 - Delete
4 - Destroy
5 - ExploreTree
6 - ModifyPermissions

Hope this sheds more light to the security handling.
Please let us know if you need more details.

Regards,
Zdenek Cetkovsky, Kentico