From what I can understand the nested team area inherits the permission/operation of the parent if it is not configured. However I can't figure out how to effectively restrict the SCM/delivery permissions of non-members of a nested team without resorting to either:

* moving the nested team area out of the parent team, or
* adding a bogus precondition on the nested team area like a pseudo approval from team members.

We have a need to maintain a nested team area structure such that

  (TA) - PTA (*Parent Team area)

    |--- User1 [Team Member]

    |--- User2 [Team Lead]

    |

    |  (TA) NTA (*Nested Team area)

        |--- User2 [Team Member]

NTA permission for Everyone was unchecked (first attempt was keep as is, second attemp was to uncheck the Source Control parent and then uncheck). PTA Source Control (client) Operation for Team Member and Everyone has a precondition for required Work Item and comments, while in NTA the Everyone operation is empty.

User1 can still create workspaces on Streams under NTA and deliver changes as long as the required precondition in PTA is met. Is there an easier and more elegant way of effecting the SCM restriction? Is there an explicit deny operation action such that

	{permissions}

	    {role id="default"}

	        {operation id="com.ibm.team.scm.server.deliver"}

	            {action id="deny"/}

	        {/operation}

	        {operation id="com.ibm.team.scm.server.modifyStream"}

	            {action id="deny"/}

	        {/operation}

	        {operation id="com.ibm.team.scm.server.modifyComponent"}

	            {action id="deny"/}

	        {/operation}

	    {/role}

	    {role id="Team Member"}

	        {operation id="com.ibm.team.scm.server.deliver"}

	            {action id="any"/}

	        {/operation}

	        {operation id="com.ibm.team.scm.server.modifyStream"}

	            {action id="any"/}

	        {/operation}

	        {operation id="com.ibm.team.scm.server.modifyComponent"}

	            {action id="any"/}

	        {/operation}

	    {/role}

	{/permissions}



	{behavior}

	    {role id="Team Member"}

	        {operation id="com.ibm.team.scm.client.deliver"}

	            {preconditions}

	                {precondition description="Require a work item, comment, or both when a change set is delivered." id="com.ibm.team.process.deliver.requireWorkItem" name="Require Work items and Comments" xmlns="http://com.ibm.team.process/requireWorkItem"/}

	            {/preconditions}

	        {/operation}

	    {/role}

	{/behavior}

We are currently using RTC 1.0.1. Thanks.

ciao!