* *can_read* on a Collection grants permission to read the blocks that make up the collection (API server returns signed blocks)
* If User or Group X *can_FOO* Group A, and Group A *can_manage* User B, then X *can_FOO* _everything that User B can_FOO_.
* *can_read* on a Collection grants permission to read the blocks that make up the collection (API server returns signed blocks)
* If User or Group X *can_FOO* Group A, and Group A *can_manage* User B, then X *can_FOO* _everything that User B can_FOO_.