It’s pretty straightforward but there are some caveats:

First, whatever permissions you set on a folder automatically cascade down to all objects within.  You cannot override the permissions on those objects without also changing the permissions back at the top.  So you want to be sure that you start with the most restrictive at the top of your structure and then get more granular as you drill down.

Now, as for the caveats, within Box you can add people to groups (if you are an admin).  The good news is that you can add someone to two different groups and the group with the superseding privileges will win out.  Therefore, you can simultaneously give someone restrictive access to a folder structure but at any point you can add the group that they are in with more elevated privileges and those will supersede any remaining folders in the structure without changing the folders above.

So, in short, waterfall permissions dictate that whatever you set at a folder level will automatically and irrevocably set the same permissions for everything below it.  This can be overridden by using groups (even if they have only one person) at any point in the “waterfall.”  Hope that helps!

-Nate