I truly don't believe that anyone at PTC responsible for this stuff actually tries to administer a real system. If they did, each would come to the conclusion within a day that all ACL's which are common to a group of Products and Libraries should be deleted from the them and brought to Org level. Super laborious to make an agreed change one by one across 85 Products and 13 Libraries.
Note: Using "Private" for some contexts is also critical to make this work well (meaning avoid use of DENY like the plague).
- Examine all the ACL's resulting from creating a Product/Lib from the OTB templates.
- Decide which are common to many Products/Lib's; create these at Org, PDM and delete from Product/Lib; save result as new Product/Lib templates.
- By exception and with careful documentation, add some to individual Product/Lib
- For some contexts (esp. Lib's), make Private, which removes inheritance from Org/PDM and makes that context only use the ACL's in it.
- Try to start with 'no user can do anything and add each as needed (avoids DENY)
- Look carefully at the effect (many OTB) of the pseudo-role TeamMembers, which can wreak havoc unless you really understand what it's doing
- Have to think in 5 dimensions: to what (object type), when (at what state), who (principals), what can be done (permissions)
- Even with all this done superbly, you'll get completely messed up unless you null out the many "implies": properties that automatically select additional permissions when you select any (see my other rants on this one)
- Confirm all using Manage Security
- Best for Manage Security is to create objects (i.e. CAD Doc), one at each state in each representative Product/Lib and leave permanently, and then create some test users than can be used to confirm.
- Big decision to be made for every single ACL is to use a Group or a Role (context team role exposed at Org level). Over time, I've moved almost all to the Role instead of directly to Groups. This also facilitates use of Shared Teams where possible.
Don't mean to sound negative here - I actually truly love the puzzle of figuring out the most elegant and robust way to approach user permissions, with related groups, roles, etc.