Fine grained group permissions

[Scott R]

We are having a significant problem involving permissions. Too many users in administrative roles that they do not need to be in so they can modify a project, or add something the team needs. 

My question is this: Is it possible to create a group and provide fine grained permissions to only provide a user with the rights they need to perform their role? I'm certain that I am not the first person to run into this issue, but I can't find any documentation on how to crack this nut.

[Scott R]

I believe I have to start with a schema. Are all rights for Jira, as well as Confluence derived from the applied Schema? If a user is in multiple groups, do they get the greatest possible rights from both groups?

[Scott R]

Bueller?