Yes, I think it does work. I created two groups, made one a component of the other, and added a user to the component group. I then created a bboard, removed the inherited permissions and added permissions for the composite (first) group. The user I added could post and read to the bboard.
Now I'm having trouble with the user admin pages, see my thread at
https://openacs.org/bboard/q-and-a-fetch-msg.tcl?msg_id=0003zy&topic_id=11&topic=OpenACS
