Excellent resource. Coming from vBulletin, I was indeed misinterpreting the hierarchical/cumulative permissions structure in Xenforo. That meant effectively that I was inadvertently denying certain permissions to admins and moderators because they weren't also in the registered users group. Thank you.