permissions system is confusing

I've managed to do it before, but I'm starting over from scratch and trying to be methodical and I've forgotten something. When I add a new user "testuser" and a group "testgroup" and make no changes to anything, things work as expected. However, the more I try to hone the permissions for group "testgroup" the less certain I am what is supposed to happen. For example, it proves to be extremely easy to disable the ability to logout. How do I leave this ability for specific users and/or members of a group. Also, at times, if I DO lose the ability to log out for a given user, I also lose the ability to login, period. I've had to start over from scratch quite a few times because I'm suddenly unable to log back in, even though I never touched permissions for admin/pier and the admin group. Lawson