The nation permission system is very flexible, you can assign players to one or more groups in your nation and each group has a name, and permissions for what they can do.
Here are some things to know.

• Nations have groups, use /nation group help for details. to view all the commands available.
• use /nation group create to make a new group
• Groups have permissions.
• Groups can have zones.
• Groups can have players, use /nation group add-player Trusted Notch to add player Notch to the Trusted group.
• A player can be in more than one group.
• You can set time limits in hours on group membership (optional). /nation group add-player Trusted Notch 24
• You can add players to groups who are not part of the nation, however there are restrictions.
• Permissions do NOT inherit from any other groups.
• Nations always has one founder group and one default group.
• New nation members will automatically be added to the default group.
• There must always be at least one player in the founder group.
• There are special permissions that DO care about the order of the groups (all permissions that contain: "SUB_GROUP")
• These special permissions include things like adding and removing players from the groups below you.
• You cannot enable a permission for another group if you do not have that permission as well.
• You cannot edit your own group.
• The founder group can always edit their own permissions.
• Anyone with the KICK permission can kick anyone in the nation except founders.

You can view the nation groups using /nation group command in game.
The interface is click based. mouse over the permissions to get a description of them.

You can make the structure as complicated or simple as you like.

Zones

Towns can create zones, these are used to control access to certain areas of your town. For example, you may want to set a zone to restrict your vault to only trusted citizens.

Pistons cannot push or pull blocks in zones unless the piston itself is in the same zone.

A zone is defined using a gold axe by left-clicking in one corner of the zone, and then right-clicking in the opposite corner. you can then use /town zone create myCoolZone You will then be asked to confirm and select what group will be the admins of the zone. You must have the MANAGE_ZONES permission to create zones.

You can attach a zone to multiple groups with different levels of access.
In the example below trusted players can break blocks, but recruits can only interact (open doors).

Use /town zone to list all zones. Then /town zone info myCoolZone for details.

Managers are players who can edit the zone because they hold the MANAGE_ZONES permission in any of the parent groups above any of the admin groups. In this case, Macus17 is in the Founder group which has the MANAGE_ZONES permission and is the parent of the Trusted group, which has admin access to the zone.

You are able to add non-citizens to groups, so you can create 'embassies' for your foreign allies if you want to. Players who are not citizens CAN be added to groups that have zone access, however the foreign players must not have build access to more than 256 blocks of space for more than 2 hours.
You are allowed to add them but only if you set a time limit of less than 2 hours on their membership using the command /nation group add-foreign-player Trusted Notch 2 There is no size restriction for interact access.

Right click with a feather to see what zones are applied to a block and who can access it.

You can use /town zone expand MyCoolZone 23 N to expand a zone 23 blocks northward.

Weak and Strong zones

If two strong zones overlap, you need access to both. But if a weak zone overlaps with a strong zone you only need access to the strong zone.

Consider an apartment building for citizens, you could put a weak zone around the whole building. Then assign each room a strong zone that permits the individual player build access to just their room. The weak zone prevents building outside the rooms but the strong zones will overrule the weak zones inside the rooms.

You can use the command /town zone type weak myCoolZone to change myCoolZone to a weak zone.