I've posted it with permission from him. - .djc. The trick with zope is understanding just what it's all about in the first place. I think it's going to still come off kind of abstract, but I'll try to give some concrete examples and drive it down to the real world eventually. But that's really giving it a seriously short shrift.
Users have roles.
Permission to role mappings can selectively be inherited from parent objects or defined at the level of any given object regardless of parent mappings. The authentication system by default relies on user objects that are defined in the object database. But since the authentication system is a component like anything else, it's possible to install alternative systems that authenticate off of other sources, like relational databases or flatfiles or LDAP servers or IMAP servers. LDAP would allow this for example. From the perspective of http PUT and ftp, Zope's object environment appears to be a filesystem of the ordinary sort, and your content shows up as expected.