Users and groups receive permissions based on the following conditions:
When you add a user or group to the object list, the user or group receives default permissions. You can increase the level of permissions, but you cannot decrease the level of permissions beyond the level of default permissions.
For example, the default group has read and write permissions. When you add a user to the object user list, the user receives read and write permissions. You can grant execute permission to the user, but you cannot remove write permission. To remove write permission, you must remove it from the default group.
Users and groups that are assigned to a group inherit permission of the parent group. Users and groups that inherit permissions from the parent group do not appear in the object user list.
Users and groups that are assigned the Administrator role for the Repository Service inherit read, write, and execute permissions. You cannot change the permissions for the administrators. Users and groups that inherit permissions from the Administrator role do not appear in the object user list.
All users and groups that you do not add to the object user list and who do not have the Administrator role for the Repository Service inherit default permissions.