I think I disagree with Stephen here, from a programmer’s point of view at least. Whether you have a user or group is irrelevant, both are objects. As I see it, they both map on top of each other and can have overlaps.
Would it be confusing in the UI, maybe. Maybe not. We don’t need to show the overlap and a user also existing in a group is irrelevant (up to the system to figure it out).
I also came across the restriction that a subcategory has to have access on the parent category level. Which makes sense kinda. I guess I could turn the whole thing around but in this particular case it would feel backwards.
I’ll show the actual use case again, much easier to explain the why’s. I might not know all the proper english words here but I think people will get the gist.
A person died and a lot of people are in the estate.
Created a read-only user for easier access (added that user to a “See group”).
Some people already on the site were also added to the group (so they won’t have to logout and switch accounts).
The top category contains common information, burial etc.
One subcategory contains money information (which is still unclear, so not released to everyone until all issues resolved). Adding a trusted man here (which could be outside the estate) doesn’t mean he would need (or even should have) access to the top category.
I’m certain I could come up with a good way to handle it with a bit of thinking. But basically being allowed to add single users into any level would solve it more beautifully (and logically).
And, all this is almost achievable using extra groups so probably not worth the effort.