Since @robmc mentioned this topic in Everyone permissions + "See" permissions - #2 by robmc, let me add a resource to this discussion from Caucus groups:
The standard access levels are:
| Keyword | Value | Description | |
|---|---|---|---|
| organizer | 40 | Full management powers for whatever the group is used in | |
| instructor | 30 | (limited organizer powers) | |
| include | 20 | ||
| readonly | 10 | ||
| exclude | 0 | No access | |
| inherit | -1 | Inherit actual access level from subgroup |
So that means you can actually put groups in groups, and exclude groups from certain things, creating a complex – or complicated – way to look at things. IMO this is a bit too fancy, and group exclusion should be enough: THIS permissions if IN GROUP X BUT NOT IN GROUP Y.