$ 0 0 So the only way to make groups work is to:apply my team group to the Modify permissioncreate a second group that is missing the person I want to have Modify apply the second group to Read permission This security model is backwards.