access permissions

I have been trying to wrap my head around permissions in Open Atrium for a bit now without success. I see that Open Atrium comes with 3 default roles - Authenticated User, Editor and Administrator which I assume are standard Drupal roles. I have read articles stating you should avoid Drupal roles and use groups to handle permissions (this is what I need in my project). I have found that simply creating a group, adding a user to it and assigning the a space to inherit members of the group doesn't seem to give the user access.

So, for module developers out there. Why do you decide to use an existing permission instead of creating one that is custom to your module?

My users access Drupal through SSO and everytime the server authorizes them, it returns a set of permissions, according to which I need to dynamically set the User's forum permissions.

So for example if a User logs in and the SSO says that he has enrolled in a course, I need to give him specific permissions for that course's forum.

Obviously I need a custom module for that, but it's a little hard to start.

I'm thinking of using the ACL module's API, but I can find any documentation or tutorial online. Is there any?

Is there a better way to get around this?

Trying to solve what would appear to be a simple problem, but frankly Drupal's handling of access/permissions/grants has my head spinning.

On one of my sites I have a View that displays a list of phone numbers submitted (via user profile) by users who agree to share them with other users who opt into the same list. The View is working nicely so now the only trick is to elegantly grant view access only to those users who have entered their own phone number into the system. Users who opt NOT to share their phone number need to be excluded from seeing the View/list.