How to correctly save and understand ACL rules when creating categories from PHP

Question

We're doing a massive import of categories from another CMS, and using the below code to create the categories:

$basePath = JPATH_ADMINISTRATOR.'/components/com_categories';
require_once $basePath.'/models/category.php';
$config  = array('table_path' => $basePath.'/tables');
$catmodel = new CategoriesModelCategory($config);
// Populate the params array with values to save, for rules:
$params['rules'] = array(
    'core.edit.state' => array(),
    'core.edit.delete' => array(),
    'core.edit.edit' => array(),
    'core.edit.state' => array(),
    'core.edit.edit.own' => array(1=>true)
);
if(!$catmodel->save($params))
    return false;

This all works marvelously, creating the category, with the Permissions as expected.

However, examining other categories that have been manually added along the way, all with the same parent_id ancestry, I see two different varieties of the rules column in the #__assets table.

#__assets rules Example #1 (as created by the above code, and some with Admin Category Manager, in use by many categories)

{
    "core.create":[],
    "core.delete":[],
    "core.edit":[],
    "core.edit.state":[],
    "core.edit.own":{"1":1}
}

#__assets rules Example #2 (as created by the Admin Category Manager, and in use by many categories)

{
    "core.create":{"6":1,"3":1},
    "core.delete":{"6":1},
    "core.edit":{"6":1,"4":1},
    "core.edit.state":{"6":1,"5":1},
    "core.edit.own":{"1":1,"6":1,"3":1}
}

When I view them in the Category manager, both categories appear to have the same permissions - inheriting everything except "Edit Own" being set to "Allowed". So, the real question is two-fold:

1. What are the differences between these two sets of rules
2. Is the method we're using (yielding example #1) incomplete in anyway

Answer 1

The rules column in the assets table define the custom rules for each item individually.

The default value of the field would be:

{"core.create":[],"core.delete":[],"core.edit":[],"core.edit.state":[],"core.edit.own":[]}

Which means that all permission rules for this item inherit their permissions from the default global configuration settings as specified for each group.

Otherwise, there are permissions overrides by item:

{"core.create":{"6":1,"3":1},"core.delete":{"6":1},"core.edit":{"6":1,"4":1},"core.edit.state":{"6":1,"5":1},"core.edit.own":{"6":1,"3":1}}

Explanation of the what a value of core.create":{"6":1,"3":0} means:

For this item the Group ID 6 has Create permissions set to "Allowed" (1), while the Group ID 3 has Create permissions set to "Denied" (0). (These permissions override the default global permissions, and all other permissions for the rest groups are inherited.)

Hope this helps...