KB222708: User groups with 'Browse' permissions cannot see objects when the 'Everyone' group has the browse permission denied.

SUMMARY:
This article describes a situation that is working by design in Strategy. The scope of this issue is limited to situations in which a particular ACL permission is denied to the 'Everyone' user group but is granted to another user group. Alternative ways to achieve the desired set of ACL permissions are described in this Tech Note.
 
SYMPTOM:
An administrator may want to prevent the majority of users from being able to browse to a particular object, but would like to allow a particular user group to browse this object. However, if the administrator denies the 'Browse' permission to the 'Everyone' group and grants this permission to another user group, individual users that belong to this second user group will not be able to see the object.
 
STEPS TO REPRODUCE:

• Create a test user group and grant all available privileges to the group EXCEPT "Bypass all object security access checks". Create a test user and assign them to this new user group.
  

• Create a test folder while logged in as an administrator. In the folder's properties, set the 'Everyone' group browse permission to 'Deny'. Set the test user group's permissions to 'View', which includes the browse permission.
  

• Log in as the test user and browse to the location of the test folder. The test folder will not be listed in the browsing window.
  

CAUSE:
This is working by design in Strategy.  When a permission is set to 'Deny' for the 'Everyone' group, this overrides the 'Grant' set on a second user group. If a user belongs to multiple user groups, permissions denied by any one of these groups will be denied to the user, even if the other user groups grant it. Additionally, you cannot remove users from the 'Everyone' group, so all users will be denied any permissions that are denied from the 'Everyone' group.
 
ACTION:
There is not currently any plan to change the behavior of permissions set at the user group level. Please see the 'Access control list' section of the Supplemental Administration Guide for more information. 
There a few alternative ways to allow only a certain user group to browse a particular object:

1. An administrator may explicitly grant the 'Browse' permission to each individual user belonging to the user group that they would like to have browse access. Permissions granted directly to individual users override any permissions set at the group level.
2. A second user group may be created with everyone NOT in the first user group. For example, an administrator could create the 'Power Users' group, and the 'Non-Power Users' group. Then they could deny the 'Browse' permission for the 'Non-Power Users' group, and grant the permission to the 'Power Users' group.