I understand permissions that control access to objects can be written/read
via the Container/Document objects. When users and groups are added to the
workgroup file, SIDs are created for each. When I create a group (Employees)
and assign explicit permissions to that group on selected database objects, I
assume SID entries are created in the database (corresponding Document
objects) to reflect this. My questions are:
1) Are SID entries created for every object in the database, even on those
objects that I did not specify any access?
2)When I add a user (Bob) to that group and don't assign any explicit
permissions to Bob, are new SIDs entries created for all the objects in my
database for this user even though no explicit permissions were assigned?

I have developed a database and deployed to several customers. During
development I am using a workgroup file that contains employee names from
separate customers and even dummy names for testing purposes (note that I
have not assigned any explicit permissions to any of these users, they are
all members of Employees). My concern is that when I deliver my update to my
different customers, does the database contain all of these useless SIDs?

This leads to the next question. I know I can delete all of these SIDs by
importing to a blank database. In this case what happens when I install the
update at my customer who has a workgroup file with a bunch of employees that
I don't have in my workgroup file? This leads me to believe that SID entries
are only created in the database for users (and groups) that have been
assigned explicit permissions, otherwise, could they be created when that
user logs in (somehow I doubt that, but you never now)?

I have tried pretty hard to research this, but am coming up empty.

Thank you in advance!
Paul