One might want to also look at the OpenACS Permissions Tedisouly Explained document, which is part of the OpenACS documentation since 4.6 (IIRC). Perhaps we should include information about the permissions work Don has done in it.
-Roberto