I think this makes sense: if I can't edit users/epriestley/, I shouldn't be able to create users/epriestley/is_dumb/? Currently, as long as I can see the parent, I can create children.

Practically, this means I can't lock down changelog/, for example.

Maybe this rule doesn't make sense, but I think it's reasonable? The only case I can think of that's a little iffy is if / is fairly locked down you'd have to create more-open subsections to let anyone do any real editing, but that seems OK.