Items always inherit their permissions from their parent folder. Each access-controlled resource (e.g. folder, collection) has a list of accesses granted on it, and each item in that list is a mapping of either:

- user -> permission level
- group -> permission level

This is best visualized by opening the "Access control" dialog on a folder in the hierarchy. The actual permission level that a user has on that resource is defined as: the maximum permission level available based on the permissions granted to any groups that the user is member of, or permissions granted to that user specifically. (Basically, just like Midas.)