SharePoint® 2010 Administration: Instant Reference

Configure Site Collection Security

While permissions can be granted to multiple site collections through the web application policy as covered in previous sections, this is only used for special cases. Users are authenticated at the web application level, and authorization is usually done at a site collection level. In other words, for regular, day-to-day permission management, permissions are assigned via individual site collections.

By default, permissions are inherited or cascade down to all websites, lists, and libraries in the site collection hierarchy. Thus, permissions granted to the top-level website also apply to a document buried deep within a site collection. As you will learn in successive sections, this inheritance can be broken. ...