Open Atrium access control problem

I wonder if anybody can help me with this problem?

My OA site is based on a number of schools, so the users are students, teachers, etc. My top-level Spaces each represent a school, eg schoolA, schoolB... Each school has sub-spaces which represent classes, eg classA1, classA2,... classB1, classB2, and so on.

I want all the students of schoolA to be able to access their respective top-level space. They can then also access their own class (ie sub-space) (which is where I have the Sections for creating content)

I don't want them to access other schools - this works OK as the top-level spaces are easily isolated.

The problem is that the sub-spaces seem to inherit access permissions from the top-level space, so that students in ClassA1 can access ClassA2.

What I would like to achieve is a situation where students cannot access other classes, indeed cannot even see links to other classes.

I have tried every configuration possible in spaces and sub-spaces but cannot find one which gives the desired result.

I thought that OA's permissions were supposed to be very granular, so I think I have probably clicked something I shouldn't have! Does anybody know how I can fix this, or perhaps advise on a better structure.

In changing the permissions I have had an error message (attached) which may give a clue to the solution.

btw I have also tried using groups but there are issues with this approach, eg allocating groups to a top-level space which then inherit to sub-spaces. Is it perhaps the case that all sub-spaces inherit users from the spaces above?

Any help much appreciated,

Colin