There are three shortcuts, and one special. The RPI memo 114 has information on ACLs and pts groups. That is, the volume owner can always give themselves access. UNIX user permissions mask the ACL permissions. ACLs contain entries from the protection database.
Groups have negative ids.
The protection database is edited via the pts command. Remove users from group. Only owners have access right. Replications and how they work. AFS also has the ability to replicate volumes.