🚀 go-pugleaf

This is actually a companion post to an article I posted called
"EXPLICIT Rights Question".  I thought if I rephrased the problem
I might get better results in achieving what we're trying to do.

We're in the process of designing the SYS:DATA directory structure and
security for our organizations Netware 3.12 servers.  We would like it
to meet the following requirements:

1)  EVERYONE has access to SYS:DATA   [R W E C F M]

2)  Our departments each have thier own GROUP DIR under SYS:DATA;
     (ie.  SYS:DATA\EXEC;  SYS:DATA\ADMIN)
   
     Each GROUP DIR has it's own corresponding NETWARE GROUP

     Each NETWARE GROUP gets a trustee assignment of [R W E C F M]
     to it's corresponding GROUP DIR   

     Each GROUP DIR has an IRM at it's head which blocks all rights to
     other users/groups

NOTE:  NETWARE GROUP EXEC must have [R F] to all GROUP DIR's
             and USER DIR's

3)  Every user has a USER DIR in thier appropriate GROUP DIR with the

     [S] right to thier own directory

    Peer users get NO rights to other users directories

    Department heads get [R F] to other users USER DIR's in thier     
    GROUP DIR

    In the event there is more than one dept head in a group,  the
    second manager get's the [R F] assignments in USER DIR's 
    of thier subordinates,  NO rights in the first managers directory


The DILEMMA:  What is the most effective way to grant trustee rights
to the group directories for the Netware groups,  while blocking
rights to peer directories for peers,  granting [R F]  to dept heads,
AND granting global [R F] to the EXEC Netware group.  

I've been wrestling with this for a couple of days now;  if there is
an efficient way to pull this off I haven't come acrost it yet.  It
would be great if this plan could come together...ideas?