Here's another doc that tries to explain the permissions model that OpenACS uses: https://openacs.org/doc/openacs-5-1/permissions.html