I've been thinking about this some more, and it's going to get confusing when permissions are mapped onto inherited taxonomies.  This might be where @ares is coming from.

Consider that A (Czech Republic) has cz.redhat.com assigned to it, and we want everybody within CZ nested locations to be able to use it.  We also define brq.cz.redhat.com and assign it to B (Brno).

We then create @ares a user account and assign him edit permissions to Brno.  In my head, I intend for him to only be able to edit brq.cz.redhat.com, but to be able to view and use cz.redhat.com.

I don't think we want view/edit permissions to work differently, so the solution (subject to the new filters system) appears to me to give him two permissions:

* view_domains to cz.redhat.com
* edit_domains to brq.cz.redhat.com

And if you do that, you don't want to inherit objects from parents automatically, right?  You'd make it explicit as two separate filters, and only associate to the taxonomy you're assigned to and those below it.