hiflyerx wrote
I believe the ACLM works the opposite way - Allows override Disallows.
No it doesn't. If you disallow edits in namespace foo: they are disabled for the whole namespace tree below foo: - if you want to enable writing for foo:bar: you have to explicitely allow it again. So you allow writing for the root namespace and dissallow edits for your particular namespace. Any other namespace will inherit the permissions of the root namespace if not otherwise set.