Site Rights for CMS

Picking up from yesterdays discussion of user and group rights, today I am adding site wide rights.

I opted to make this pretty simple. A group can be assigned a site wide rights profile.

For every object that profile will be used (for a user in that group) only if no other rights are specified.

For example lets say we have object "Hot News".

That object has no groups or users assigned to it.

I am assigned to the "admin" group and that group is given site wide profile with basically all rights turned on.

When I visit the Hot News object I have rights ofr everything automatically.

However if we then add the group "admin" to that object specifically and set:

Group Admin: Edit, Display

At this point Group has greater weight than Site wide rights and even though I have rights for both profiles the group profile is what is used.

I have the weight broken down like this.

User > Group > Site.

This way a user profile will always override a group profile and a group profile will always override a site profile.

So in this system one can give a group rights to everything with site wide rights, and then on the Privacy Policy page explicitly assign that user or group Edit only rights, with approval coming from the legal group. Quick and easy I think...

Anything I missed? Does this make sense to anyone else besides me?