CMS Do section permissions really work?
 

I've been really struggling, trying to make sense out of the CMS permission system. I've read the docs and several posts on this, but I'm either missing something, or the product is...

I'll give you an example based on my dev system.

I have a top level section called "Customer Support". First, there can only be one section at the top level, is this correct?

Now, under "Customer Support", I have several "Company" sub-sections, like this:

>Customer Support
----> Company A
----> Company B

I have usergroups defined, lets call them "Company A Group" and "Company B Group".

I want Company A Group to ONLY be able to access the Company A section. Likewise, I want Company B Group to only be able to access the Company B section. By access, I mean "Read" and 'Download Attachments'.

In order for Company A and B group to see anything, they need to have their permissions set at the top section 'Customer Support'. Then, for section Company A, I have only given Company Group A their Read and Download Attachments permissions. Likewise, for section Company B I have given the Company Group B their permissions.

It seems like this should work, yet it doesn't always. If I log in with a user from Company Group A, and then type in the URL that represents Company Group B's section (lets just say /content.php?2-company-b) the user can see the section and it's widgets. The only time it will deny access to the section is if an article is on that section with the "Display Full Article in Section Page" enabled. If the section simply has article 'previews', it doesn't perform the validation check and the user is allowed to see the preview (not the full articles) as well as widget content on the page. This seems like a flaw. Am I missing anything?