We've just (finally) upgraded from United version 8.3.x to RIO 10.4, now using LFDS and I'm struggling with a security/permissions issue.  

I have a department specific AD security group that is tied to a Group in LFDS that defines that departments basic access rights (basically to view documents only). 

For a few specific individuals in that AD security group, I need to override those basic access rights with the ability to edit those same documents.

In the united version, I was able to define a Laserfiche User that was tied to a specific AD user that was a member of that same departments AD security group and give them different permissions.  Much of our access rights security has been based on this methodology and I'm not finding a way to replicate it within LFDS under RIO.  

The version 10 administration documentation says that security is cumulative which doesn't seem to be correct.  It appears that the effective rights end up being whatever is the most restrictive, as nowhere in the access rights definitions have I set and "deny" rules.

Thanks in advance!