Permissions have three states. For each user, a permission at a resource can be
- explicitely or inherited (from a parent folder) set as allowed,
- explicitely or inherited denied, or
To unset inherited permissions they must be overwritten ("Overwrite inherited" in the permissions dialog). This can only be done for all permissions of a user or group at once.
What happens now, if permissions for a user belonging to one or several groups has different permissions for accessing a resource?
In OpenCms denied is always stronger than allowed.
That means, if, for a resource the access is denied for a user, because it is denied for a group, the user belongs to. It will stay denied for the user, even if he is member in another group that explicitely has access to the resource, or even if access is granted directly for the user.
In such a setting it makes sense to have permissions unset. When a permission is not set for a user, directly or indirectly via a group or role, the user does not have the permission. If it is then set to allowed somehow, directly or indirectly, the permission is granted. Thus unset is like a "weak deny" that can be overwritten.