Subversion access control for repo sub-folders

You forgot some obvious things (in attempt 1, which must to fail)

• ACLs are inherited from parents notes to child
• If you want to have changed rule, you must to write a rule, modifying access-rights
• If you use authz-file with Apache-served repository, you must to have
  • related directive in SVN-Location
  • LoadModule for path-based authorization

(and last point may be main reason – you just doesn’t have path based authorization, and I can’t check default settings of CollabNet)

thus, for group-centric game you have:

1. @Junk_repo_team have access to root of Junk_repo
2. @Junk_repo_team and @Junk_repo_comm_team have access to /Commercial node (direct rule and inherited)
3. @Junk_repo_team and @Junk_repo_mil_team have access to /Military node (direct rule and inherited) – thus, Joe as member of @Junk_repo_team have access to node

Second ruleset with personal access is almost OK on the first sight and only some shortening (due to rule-inheritance) may be applied immediately, something like:

[Junk_repo:/]
domain\beth = rw
domain\eric = rw
domain\joe = rw

[Junk_repo:/Military]
domain\joe=

(inherited from root rules can be skipped, only redefining rules must be used)
and in this form I expect to see “No access” for Joe.

But, because you used rather old version of SVN Book (which doesn’t note aliases) and I can’t recall, is domain\joe applicable form of username in auth-file or not and can’t test your setup (you didn’t show any log-output for any revision of any user, but LDAP-based names can have different forms)
I’ll suggest slightly polished setups (with minimal differences: both with aliases, one is group-based, next have group-only rules), based on original SVN Book for SVN 1.8

Some authentication systems expect and carry relatively short usernames of the sorts we’ve been describing here—harry, sally, joe, and so on. But other authentication systems—such as those which use LDAP stores or SSL client certificates—may carry much more complex usernames. For example, Harry’s username in an LDAP-protected system might be CN=Harold Hacker,OU=Engineers,DC=red-bean,DC=com. With usernames like that, the access file can become quite bloated with long or obscure usernames that are easy to mistype.
Fortunately, Subversion 1.5 introduced username aliases to the access file syntax. Username aliases allow you to have to type the correct complex username only once, in a statement which assigns to it a more easily digestable alias.

AD-based usernames are exactly the such case, thus we’ll aliasing all users before defining rules and groups (for 1-st configuration)

Group-based config

[aliases]
beth = full and tested username of beth
eric = full and tested username of eric
joe = full and tested username of joe
[groups]
Junk_repo_team = &beth, &eric, &joe
Junk_repo_comm_team = &beth, &eric, &joe
Junk_repo_mil_team = &beth, &eric

[Junk_repo:/]
@Junk_repo_team = rw

[Junk_repo:/Commercial]
@Junk_repo_team = // no inheritance mess!!! only direct-rules
@Junk_repo_comm_team = rw

[Junk_repo:/Military]
@Junk_repo_team = // no inheritance mess!!! only direct-rules
@Junk_repo_mil_team = rw

(I can ignore suppressing inherited rules for Commercial, but not for Military and selected sameness for both nodes)

User-based config

[aliases]
beth = full and tested username of beth
eric = full and tested username of eric
joe = full and tested username of joe

[Junk_repo:/]
&beth = rw
&eric = rw
&joe = rw

[Junk_repo:/Military]
&joe =

PS: Collabnet’s SVN-stack was good at the times of CollabNet Edge, today’s preferable solution (from my POV) is Visual SVN Server with all up-to-date features, GUI management console (for all tasks), remote administration…