Hi HomerJ,
Permissions are handled according to the groups in which the users are assigned. What happens and creates issues is related to the groups the users are assigned.
If the user is part of a system group (Viewer, TDAdmin, Developer...) the permissions set for that group would overwrite the new group permissions assigned. If the user is part of other custom groups, the group that has the most permissions set would overwrite the most restrictive one. If the user is part of more than one group, the permissions are affected by the above permissions settings.
I hope this helps to answer and clarify your question. For the above stated reasons it is highly recommended that the users only be the member of one specific group so that the permissions desired can be guaranteed to be assigned.
Thanks,
Dan