Ok! After some false starts, I think I've got permissions actually working this time. :-)