table:

1.6.2
------------------------------------------------------------------------
perm                    allows as                allows as
name                   group perm               objectperm
------------------------------------------------------------------------
view_ws                     -               -view the ws

create_resour               -               -create resour onws

admin_ws           do all on any ws         -add group/user to ws


1.7.x 
-----------------------------------------------------------------------
perm                    allows as                allows as
name                   group perm               objectperm
------------------------------------------------------------------------
view_ws                     -              -view the ws

create_resour               - (1)          -create resour on ws
(de facto admin resour)
		                           -change perms on ws
                                            resources (excluded
                                            the ws itself)
                                            choosing from the
                                            father ws groups and childs
                                            (father+brothers-to-bottom)
                                            (3)

                                           -add single users(not groups)
                                            to ws predefined groups

admin_ws           -do all on any ws(2)    -create child workspaces for
                                            any ws from the topmost ws
                                            he has admin rights

                                           -change perms on ws object
                                            itself & resources &
                                            child-ws objects and
                                            resources choosing from
                                            the topmost ws groups 
                                            he has admin rights   

                                           -add any groups to any ws
                                            choosing from the 
                                            topmost ws groups 
                                            he has admin rights

                                           -create child workspaces to
                                            any ws from the topmost ws
                                            he has admin rights

notes:
(1) this slot is free! Can't we use it to allow the creation of an 
    'organic workspace' of some predefined type with himself as
     tiki_p_create_resour objectperm on it?

(2) as he can add the 'admins' group, and add users to it, he is
    defacto a tiki_p_admin.
    maybe he should only be able to add 'workspaces groups'? This would
    make him different from a tiki_p_admin_groups and tiki_p_admin.
    see comments and examples of different possiblties in
    mod-workspaces_users_groups.php

(3) see comments and examples of different possiblties in 
    tiki-workspaces_objectpermissions.php
---------------------------------------------------------------------
TODO:
there's quite a lot I think, especially in the interface, making it
nicer and more intuitive.
-Add confirmation steps for various deletion actions
-test it really hard
-understand first, and maybe integrate, the working of 'Private Zones'
and 'user Workspace types' (isuserWS and userws filed in table).