[cvsnt] acl questions

[Mark Johnson]

I am using cvsnt server version 2.5.02 (Servalan) Build 2088 on linux,
and cvsnt client version 2.5.02 (Servalan) Build 2064 on windows
clients.  I am trying to implement acls.  I currently do not have any
acls set and am controlling write access to the file system with OS
permissions using a single group...this kind of works for a single
group, except when a new directory is created "other" has full write
access.

I am confused about a couple acl issues.  I assume I need to start by
setting a global acl for each top level module either granting
everyone read access (cvs chacl -a read modulename)  or "no read"
access (cvs chacl -a no read modulename) based on our local policy. 
Then I would create groups, and add users to these groups, and create
acl's for these groups granting different permissions as desired.  Is
this correct?
Does the order in which I create the acl's matter?
If I first create a no access for anyone acl, will I then not be able
to modify or create any more acl's?....can I lock myself out?
Is there a way to create an acl for the repository (top level), or it
the highest level a directory with in a repository (module)?

I have read the documentation, and poked around through the list, but
have not found these answers.  If there is more complete acl
documentation/instructions somewhere, please point me there.

Thanks,

Mark Johnson