Anthony asked...
> Suppose you wanted to restrict file access such that a user may
> only edit files in one specific group and no others.  How would
> you configure this?

I am using the GL capability for this. I find it much more convenient
than using GU access right and passwords at the group level. I assign
access rights like (R,X:AC;W,A,S:GL) to the groups, put users in their
"own" home groups and grant them CAP=+GL.

This way, they have full access to files in their HOME group and only
limited access to files in other groups. Regardless whether they use
CHGROUP or not.

Lars.