By default, the "default" permission group (described by the "default.json" file in the permissions folder) applies to every player on the server automatically. This is also the base permission for all group and area permissions.
If you create a group permission, it inherits the default permission, but keeps every key specified in the group permission. The same applies to all area permissions.
If a player enters an area (irrespective of whether or not he's assigned to a permission group), the game first checks if the area has a player-specific permission (which is set up via "Add Player" in the area radial menu). In this case, this permission will be applied to the player (but only stays active as long as he's inside the area). If there is no player-specific permission assigned to the area, the game checks if there is a general permission assigned to the area - then this one will be used for the player (but again, only as long as he's inside the area).
Once a player leaves an area, his group-specific permission (or the default permission if the player is not assigned to any permission group) takes effect again.
Yeah, that's unfortunately a bug This will be fixed with the next update!
Oh, thanks for letting us know! This is indeed a bug, we will fix it with the next update