Access control inheritance issue

Hi,

I am putting my acls in format allow;jcr:all;product;/content in Day CQ Acl Setup xml file. I need to restrict certain pages for some groups but allow most of the other pages to be editable. All these pages are within the same hierarchy. When i allow access of jcr:all to the parent then those access are being inherited by child pages irrespective of the fact that i have also defined jcr:read for child pages. I moved these permission one after another and reversed the order as well but nothing seems to affect at all. I was using useradmin screen to view my changes and using 5.6.1 AEM instance.

There has been an observation where if you provide more access to a group and then remove access then you have to manually change the user permissions from the user admin screen. I downgraded the permission but that did not affect at all as well.

I looked at the documentation at link but seems a bit unclear on the inheritance front.

1. When you set allow or deny permission on a given node then 3 scenarios are possible:
   1. if the same ACE (Access Control Entry) is being inherited from a parent node and no matching ACE already exists on the node then nothing will be done.
   2. if the same ACE is being inherited from a parent node and a matching ACE is already defined on that path then it will be removed.
   3. if the same ACE is not being inherited from a parent node then the ACE will be created for that node.

Any help will be appreciated.