Kahua’s permissions can be set at the root, or any partition, and follow the inheritance model. This means that if I set up a group at the root (Domain level), any users set up at the root will have this level of permission from the root downward in the hierarchy. I may override the permissions (both permission by app and users in that group) at any level in the hierarchy to manage each user’s permission across my hierarchy structure.
For instance, if I have a user in a ‘Project Manager’ group who should only see projects in a particular region, I would add that user at the Regional node to the group – they would see all projects from the node downward in the hierarchy at the group’s permission level.
See more details in the referenced articles here on creating new groups, adding/removing users from groups, and updating permissions in a group.