Relational segments can be thought of as being subgroups of a group, yes. The basic idea is to define an acs-rel that's derived from membership_rel, say "admin_rel" and then to a relational segment that represents all members of the parent group that also belong to the "admin_rel". Think of this as defining a role and the relseg as the set of all members of a given group who hold that role.
As far as documentation goes ... aD added these close to the end of Tcl ACS 4 and documentation never got written. I'd love to find time to write some but haven't, nor has anyone else who has used them. Sigh.
As far as .LRN goes ... the basic users, admin, etc relsegs created globally have no semantic meaning within the system, they're just used as a way to label people. A professor at an institution might be enrolled as a student of a class, for instance, so perms aren't granted to their global role. Communities and classes each create relsegs specific to themselves which are used to grant permissions (professors are admins in classes, there's admin and plain users in communities, etc)
Does this help?
