We have the groups: SysOp |___Tech2 |___Tech1 We have these users: User1 User2 User3 User1 Write rights to SysOp User2 Write rights to Tech2 User3 Write rights to Tech1 User2 does not "see" the passwords in the Tech1 group.