This url offers some sql that may be helpful in identifying blocking points in permissions inheritence.
http://grumet.net/writing/programmer/openacs/forum-permissions
and this followup page may help explain how it is supposed to work
http://grumet.net/writing/programmer/openacs/guests-in-dotlrn