table:

1.6.2
------------------------------------------------------------------------
perm                    allows as                allows as
name                   group perm               objectperm
------------------------------------------------------------------------
view_ws                     -               -view the ws

create_resour               -               -create resour onws

admin_ws           do all on any ws         -add group/user to ws


1.7.x 
-----------------------------------------------------------------------
perm                    allows as                allows as
name                   group perm               objectperm
------------------------------------------------------------------------
view_ws                     -              -view the ws

create_resour               - (1)          -create resour on ws
(de facto admin resour)
		                           -change perms on ws
                                            objects itself and child
                                            choosing from the
                                            father ws groups and childs
                                            (father+allbrothers-to-bottom)
                                            (3)

                                           -add single users (not groups)
                                            to ws predefined groups

admin_ws           -do all on any ws(2)    -create child workspaces to any
                                            ws from the topmost ws
                                            he has admin rights

                                           -change perms on ws object
                                            & child-ws objects and 
                                            resources

                                           -add any groups to any ws
                                            choosing from the 
                                            topmost ws groups 
                                            he has admin rights   
                                            
                                           -change perms on ws
                                            objects itself and child
                                            choosing from the 
                                            topmost ws groups 
                                            he has admin rights   

                                           -create child workspaces to any
                                            ws from the topmost ws 
                                            he has admin rights

notes:
(1) this slot is free! Can't we use it to allow the creation of an 'organic workspace'
    of some predefined type with himself as tiki_p_create_resour objectperm on it?

(2) as he can add the 'admins' group, and add users to it, he is de facto a tiki_p_admin.
    maybe he should only be able to add 'workspaces groups'? This would make him different 
    from a tiki_p_admin_groups and tiki_p_admin.
    see comments and examples of different possiblties in mod-workspaces_users_groups.php

(3) see comments and examples of different possiblties in tiki-workspaces_objectpermissions.php