I've explained [SDL Tridion authorization and basic practices][1] but I'm not sure how the Group "available for setting permissions" setting completely works. I understand the publications a user sees in the Content Manager Explorer is an intersection (subset) of all the "member of" scope settings from the groups the user belongs to per the [User Groups documentation][2] ([requires login.](http://docportal.sdl.com/sdltridion)) Publications ------------ For example, I have the following publications: * Content * Design * Website Scenario A: Typical Scope Setup ---------- * User belongs to *Marketing Authors* group with "member of" scope set to `All`. * *Marketing Authors* belongs to *Authors* with membership scope set to publications *Content* and *Website*. * All groups and users have "available for setting permissions" set to `All.` * Each publication has the *Authors* group with `Component Management` rights. User sees two publications, *Content* and *Website*, since membership scope is an intersection of each `member of` scope setting. Scenario B: "Available For" Setup ---------- * User belongs to *Marketing Authors* group with "member of" scope set to `All`. * ***Marketing Authors* belongs to *Authors* with membership scope set to *`All`* (rather than just *Content* and *Website*).** * ***Marketing Authors* also has "available for setting permissions" set to *Content* and *Website* only.** * Each publication has the *Authors* group with `Component Management` rights. However, with this setup, users can see the *Design* publication. *It looks like because a user belongs to a group that belongs to another group that has (any) rights in a publication, the user sees that publication.* **How does the "available for setting permissions" setting work? Is it different from membership scope?** [1]: http://www.createandbreak.net/2012/07/sdl-tridion-authorization.html [2]: http://sdllivecontent.sdl.com/LiveContent/content/en-US/SDL_Tridion_2011_SPONE/concept_8F0AB75E70374708A7F1234097590174