Hi @smartCarleen 
Yes you are correct. Role inheritance still works for Role, so if you want that behavior you can select that. But with RoleExplicit adds the "nuanced permission". I cannot remember if I tested it with group inheritance. But I definitely tested the role inheritance from the example. So Admin, although inheriting the role, could not access when using RoleExplicit.

 

To me it would make sense that you still have access if the exact "user"-role (from your example) is granted via a group, that the user with that role still has access. I would assume that counts as giving the users in the group explicitly that role. But you are also correct that it is group-inheritance, so a form of inheritance...🤔