[cvsnt] Is it possible to lock a user out of HEAD, but grant them full access to a branch?

[Terry Beavers]

I thought I was finally starting to understand the use of ACL's and
branch locking, but have now come across a scenario that doesn't seem to
work.
 
Basically, we want to grant full access to a user on a branch, but want
to give that user READ ONLY access on HEAD.
 
The problem is when I setup the following ACL's (see below), the user is
able to write to existing files on the branch, is unable to create new
files on the branch as it seems as though CVSNT is attempting to create
new files through HEAD in the background, or at least that is what
Fisheye reports when creating new files on a branch.
 
Not only do we receive an email from Fisheye reporting the new file
added on the branch, but we also receive an email that reports the new
file has been added on HEAD as well, although the file doesn't
physically reside on HEAD at that point, only the branch.
 
Anyway, here are the ACL's that I used to try to lock down HEAD with
READ only, but give full access to the branch
 
Lock down HEAD for READ only access
 
      cvs chacl -R -u tbeavers -a read,nowrite,notag,nocontrol,nocreate
main_dir/ 
 
Grant FULL access to TERRY_BRANCH
 
      cvs chacl -R -r TERRY_BRANCH -u tbeavers -a all main_dir/
 
 
Any help in this matter would be gratefully appreciated.
 
Thanks for your support,
 
Terry