Elevator contains a robust permission system, which can be a bit overwhelming.
Permissions can be set on Instances, Collections, and Drawers. Collection permissions can only be more permissive than instances – IE, an instance may be set to not allow downloads, but a specific collection can override that setting.
Setting permissions on drawers, instances and collections is done in the same way, via a similar interface.
Additional documents are below. We also have two screencasts describing the most common permissions-related tasks.