I need to and want to understand how to use the IRF. This is exactly what I don't understand. If I have a container named A and a user object inside of container A that is named B, and I apply the irf of S and I on object B, does that mean that these two rights will not flow into trustees of B or does it mean that I am not allowing B to inherite these two rights from A, or does it mean that I am not allowing A to inherit those two rights from B. Does it block rights from flowing down from a higher container or object or is it blocking higher containers or objects from having certain rights from a lower object. Please try to explain this in simple terms for me. Thank you

An IRF, or Inherited Rights Filter, is used to block rights, either object and property rights in NDS or file system rights in the file system, from flowing downward. This is the only direction rights can flow. In your example, the IRF would be placed on the container A to block S and I from applying to any object inside A and any subcontainer inside A as well. This implies that S and I have been assigned to a container ABOVE container A in the first place. Rights do not flow from one leaf object to another, such as from one user object to another. In order for user object B to have the Supervisor object right to user object C user object B will have to be given an explicit trustee assignment to user object C. If the container is made a trustee of user object B or C, all objects inside container A will be trustees of user object B or C. Containers are used for global trustee assignments and the S object right is used very sparingly as a result. I hope this helped.