I'm a little confused about how sharepoint permissions are propagated. Leaving inheritance on, I go to my subsite and grant "group1" the read permissions level. But now if I view the permissions at the site collection level I see that group has was given read access there to. So does this mean I can't have some permissions inherited from the root and add uninherited permissions for specific sites? This is how AD permissions works and I'm surprised sharepoint doesn't do this.
With AD permissions inheritance I can do something like this: -Top level folder: group1 read access --Sub Folder: group1 read access (inherited from Top), group2 read access (not inherited) ---Sub Sub Folder: group1 read access (inherited from Top), group2 read access (inherited from Sub Folder), group3 read access (not inherited)
I want to give some groups access at the top of the site collection and have that propagated via inheritance down to all my site. I then want to give other groups access to specific sites without breaking inheritance. Is this possible or am I misunderstanding how this works?