NDS (Netware Directory Services) works in the same fashion, which makes sense for the most part (I assume Active Directory works similarly). However...... In a forum environment, this presents an issue. You can't treat a forum like you would "containers" on a network. In XenForo, there should be just a yes or no. But there isn't. There's yes, no, and in your freakin' dreams. HUH? Either you have access or you don't. Why are there three options when setting permissions? If there were just yes and no, I'd be happy. I could set up the user groups in the manner I've always set them up and I'd KNOW that my permissions were tight. But nooooooooooooooooooo! XF has to make it difficult and force you into a situation where if you explicitly block a specific forum (using the "in your freakin' dream" setting), you're screwed as it affects every other usergroup. That's wrong. Permission settings should affect just the one usergroup. Not all of them.