I've explained SDL Tridion authorization and basic practices but I'm not sure how the Group "available for setting permissions" setting completely works.

I understand the publications a user sees in the Content Manager Explorer is an intersection (subset) of all the "member of" scope settings from the groups the user belongs to per the User Groups documentation.

Publications

For example, I have the following publications:

• Content
• Design
• Website

Scenario A: Typical Scope Setup

• User belongs to Marketing Authors group with "member of" scope set to All.
• Marketing Authors belongs to Authors with membership scope set to publications Content and Website.
• All groups and users have "available for setting permissions" set to All.
• Each publication has the Authors group with Component Management rights.

User sees two publications, Content and Website, since membership scope is an intersection of each member of scope setting.

Scenario B: "Available For" Setup

• User belongs to Marketing Authors group with "member of" scope set to All.
• Marketing Authors belongs to Authors with membership scope set to All (rather than just Content and Website).
• Marketing Authors also has "available for setting permissions" set to Content and Website only.
• Each publication has the Authors group with Component Management rights.

However, with this setup, users can see the Design publication.

It looks like because a user belongs to a group that belongs to another group that has (any) rights in a publication, the user sees that publication.

How does the "available for setting permissions" setting work? Is it different from membership scope?