Read Exceptions Panel clarification

Using the read Exceptions panel in the edit section helps me assigning read access to particular roles in the system, or restricting other roles. So far, so good.

…I played with Roles of users and apparently from Editor role on (just before admin) the Read Exceptions panel starts appearing.
It seems connected with Capability

• Pp AssignRoles
• Pp Set Read Exceptions.

Apparently, the “Author” role is not meant to decide who shall (not) be able to read the post, only Editor role and up.

But kow, what is the logic behind the default settings displayed initially?

When a editor sees the panel, the defaults are set to “NO access” ({All}…) for most Roles besides the editors role (e.g. Head Of School) and up (all the admins)

Still, after saving, the panel now shows all roles green??
The post is in fact accessible for unauthenticated users.
How to understand this? (bug?) Why do we not see green from the beginning?

And it is intentional, that a role can exclude its own role and make public being able to see a post, but as soon as a user is authenticated AND belongs to the excluded role, the post is gone ? Anonymous has more rights than an authenticated user with a role?
Perhaps this is a setup that should be avoided as it is “politically incorrect”, but perhaps this is overlooked and could be restricted by an admin setting or capability?

Slowly, I understand the plugin more.

http://wordpress.org/plugins/press-permit-core/