Defining groups is an easy way to set access rights for multiple users. Groups can have individual folder rights but do not have default rights. A user can belong to multiple groups as well as have individual folder rights.
If only group access rights exist, the most permissive group takes precedence. For example, if Group A allows RC at root and Group B allows R at $/foo/bar, then group A’s access rights take precedence at $/foo/bar.
However, a single group’s access rights can be restricted by multiple rights assignments. For example, if Group A has RCA at root and R at $/foo/bar, and Group B has RC at $/foo/bar, it is Group B’s RC that takes precedence, because Group A’s R rights permission overrides its RCA at $/foo/bar. As the example shows, a group’s rights assignment closest to the folder in question take precedence over other rights assignments of that group further away.