Rights for NAL work?

[zeffan]

We brought in some talented temporary people to help us with packaging apps. We need to give them just enough rights to do their job and nothing more.
I created a group, added them as members, then high up in the tree gave Read, Write, Add Self trustee assignments as inheritable.

I gave them:
App:Associations
App:Copy Files
App:Copy Files Always
App:Description
App:FS Rights Path
App:FS Rights Volume
App:Folder Back Link
App:Folder List
App:Folder Objects
App:Folders
App:INI Settings
App:INI Settings Always
App:Icon
App:Icon Order
App:Parameters
App:Path
App:Post Distribution Script
App:Pre Distribution Script
App:Registry Settings
App:Registry Settings Always
App:Shutdown Script
App:Startup Script
App:Version String
App:Working Directory


They are still unable to do their job in the Applications container, even though I check the Trustee assignments on the container and verified that each user has properly inherited these.

Pray tell me what I'm missing......