Does it really make sense for the permission level "Manage Permissions"
(Included in Manage Heirarchy) to allow the user to manage permission
*levels* as well.
Say for example, I am a user of a site and my only role is to add and
remove individuals or groups to be able to use that site. I would
probably have a custom level that includes the minimal requirements for
Manage Permissions. This includes innocuous items, comprehesively:
Lists-> "View" "Open" "Versions"; and Permissions-> "Manage" "Browse"
"View" "Enumerate" "User Info" "Open"
The trouble is, the "manage" part also allows me to create and change
permission levels, so I could change my bare-bones custom level to
include "Delete Versions" "Create Subsites" "Override CheckOut" Well
beyond what my job function entails. It also endangers me by allowing
Site-Wide mayhem when I check one a more powerful items on an OOTB
permission level template and grant "manage lists" to the View Only
permission.
Okay, granted if I have "Manage Permissions" I could always give myself
full control and accomplish this anyway, but it seems like managing the
permissions templates should be more finely grained (split into manage
permisions and seprately manage custom levels) in its empowerments so I
can protect myself from mistakes, and simplify the interface for others.