With Laserfiche permissions, you have an implied deny (neither the allow or deny checkboxes are checked), you have an explicit allow (the allow checkbox is checked), and you have an explicit deny (the deny checkbox is checked).  An explicit allow will always override an implied deny and an explicit deny will always override both the explicit allow and  the implied deny.

When you read or hear that LF will use the least privilege, this means that if the user has an explicit deny and an explicit allow, the deny will override.  Note:  This also applies to the read only setting where if the user inherits read only from any group, they will be read only everywhere.

So with that information, the Everyone group uses the implied deny for most things, so when the user is in a group with an explicit allow, they are allowed.