As I understand it I can use CiviCRM's Access Control Lists to to control the groups that users can see and work with. But I'm not clear on a few points about this:
If a user does not have the permission to see a given group (for example in a list of groups) can they still see and work with the contacts in that group? Or to put it another way, when the ACL refers to a "group of contacts" does the permission that is granted by the ACL apply to the group, or the contacts within that group, or both?
And following on from that, if a contact is in two groups, and a user has permission to view one group but not the other, can the user see the contact at all?