Dear Andrew,
when it comes to it, permissions are just a handful of procs. Depending on your use case, having a look at the automated tests in acs-tcl/tcl/test/test-permissions-procs.tcl might be all you need. I have just provided some additional test for inheritance in [1].
One additional advanced feature that does not appear very often in the codebase is the possibility to define custom permissions that e.g. inherit from the standard read, write, admin and so on. One example of this can be found in the chat package.
Let me know if I can be of more help
Ciao
Antonio
[1] https://cvs.openacs.org/changelog/OpenACS?cs=oacs-5-10%3Aantoniop%3A20240326091006
