Best explained in an example:

Member A is a member of the Group Y

Group Y is the child of X and parent of Z

So folder structure looks like

X
| - Y
|     | - Z

Currently in silverstripe Member A has access to Group Y (of which they are a member) and Group X (of which they inherit) and not group Z.

What I required was the opposite.. so Member A has access to children rather than parent groups. By changing the code below you get Member A having access to Group Y and Group Z, not Group X.

/sapphire/security/Member.php

Changed one line the Groups() function from:

			$group->collateAncestorIDs());

to:

			$group->collateFamilyIDs());

I could not see a simpler way of changing this by not editing the core. Hope this helps some people.

thanks for the good example - yeah, it seems logical that a group inheritance should be toward more specific (=children) rather than more generic (=parents) - it allows for much more finegrained controls.
although this is a one-line fix, i think we need some unit tests to verify this behaviour (on GroupTest.php), with this hierarchy:

X (member1)
--Y1 (member2)
----Z1 (member3)
--Y2 (member4)

- member1 has access to X, Y1, Z1, Y2
- member2 has access to Y1, Z1
- member3 has access to Z1
- member4 has access to Y2

Unit tests are fairly easy to write (see http://doc.silverstripe.com/doku.php?id=testing-guide) - ScottiouS, do you want to give it a go?