Why is it that if a user is a member of two groups with opposite permissions, that user doesn't inherit the permissions?  The properties screen shows that the user is inheriting the permission and the workflow state shows the permit box as filled in (not checked and not empty), but this doesn't seem to be the case.

Example:

Everyone Group has state permissions to make a state change

Engineering Group has nothing enabled/disabled for the state change

The User has nothing enabled/disabled for the state change

if User A is a member of only the Everyone Group, he/she CAN make the state change

if User A is a member of both the Everyone Group and Engineering Group, he/she CANNOT make the state change

Correct me if I'm wrong anywhere here, but I think Windows is the opposite.  Don't you always inherit permissions unless it is specifically a deny permission?

Please tell me that I'm just missing something simple here.  I'd rather not have to apply settings to every group rather than to one Everyone group.