… this is work in progress:
http://jira.xwiki.org/browse/XWIKI-13403
For now, I use a wiki page to track the permission. To enforce permissions, I “block” accidental inheritance, I assign an empty group with all the permissions on the level I would like to enforce the permissions.
As for any structure, it is important to keep it simple …