Everything in Zope is an object (pages, images, pdf documents, scripts, etc). The objects are organised in a hierarchical fashion using containing folders, as in the adjacent illustration. It looks like a file system hierarchy, but it isn't. You can't use Unix file system commands such as ls, find, grep or mv. All objects are edited through the web and not through the file system. Access to objects is controlled using a security policy that involves Roles and Permissions. Roles describe the sorts of functions that individuals perform and Permissions indicate the actions that are allowed.
Objects within the Zope hierarchy inherit from their parents. If a particular Permission is set in a folder, that Permission is inherited by all pages, images and subfolders within the folder, and within all subfolders. Inheritance makes it very easy to restrict access to folders to groups of individuals, and to delegate responsibility for folder management to different individuals.
An example: One individual might be assigned the Manager Role in the Home folder. Let us call her Alice, the Site Manager. Alice may then assign another individual (Bob) the Editor Role in the Home folder. Alice and Bob can both create and edit pages in the Home folder and all subfolders. Alice may then give Carol the Editor role in the contacts folder, allowing Carol to create and edit pages there as required. However, Carol could not create and edit pages in the home folder or the admin folder. Alice then gives Dave the Manager role in the abs folder and asks Dave to take responsibility for everything in that folder. Dave has the Manager role in the abs folder and all its descendants, but everywhere else he has no particular role. That is delegated management!
The Manager and Editor roles are assigned to individuals using the Manage Roles form. There is also a Member role that allows creation of small groups individuals who have permission to View sets of documents. In Zope terms these are Local Roles.
Members of the School are given default roles at login. These roles originate in the personnel database and allow distinction between Staff, Postgraduates, Undergraduates, other University members, and others. Manager, Editor and Member roles are not allocated in the database because that allocates a site-wide role.