VCP5 - Describe how permissions are applied and inherited in vCenter Server

Permissions in vSphere are applied on managed entities (datacenters, folders, VMs, etc...) Permissions are propagated from the managed entity to child identities.

• Permissions applied at the same level are summed to include both sets of permission. 
• Unlike other permission inheritance schemes (which sum permissions at different levels), permissions applied at lower levels over-ride inherited permissions. 
• Permissions applied directly to a user over-ride group and inherited permissions

http://pubs.vmware.com/vsphere-50/index.jsp?topic=/com.vmware.vsphere.vcenterhost.doc_50/GUID-E1D90120-73EB-4B00-9F89-8650EBE911F7.html