As mentioned earlier, there are two special kinds of groups roles and domains. This difference is identified by the value of the group_class property. A role is a group with the group_class property set to role.
Roles and domains are intended to enable access control within applications to a more granular and specific level than what client capability provides. For example, Webtop gives priority to roles over client capability. Further, custom roles can be created and used in Webtop via customization. As with client capability, roles and domains have meanings to client applications only and the Content Server does not assign any special meaning to them.
Roles can form an inheritance hierarchy similar to an object-oriented inheritance hierarchy. When a role is added to another role, the member role is called a sub-role or derived role. The containing role is called the parent role or the base role. The sub-role is said to inherit from the parent role. This relationship is similar to...