Match permissions for RO and SO set in SCSM

Currently in the portal, if you add a SO to the portal it also gives permission to all RO below it. This makes it difficult to use a SO with multiple ROs but restricting access to a particular one. E.g. Having an "End Users" SO that contains an RO called "Request Invoice" that should only be viewable by Department Heads. In the current system you have to create a standalone SO with just this "Request Invoice" in order to restrict it's access.

The feature would be to mimic SCSM group permissions so require either access to both the SO and the RO or at least be able to exclude an RO.