I've just checked into CVS updated section handling code that verifies if a user (or the public user 'Everybody') has been given read privileges to a requested section. Remember, sections are what make up the page-based content management part of Syntax CMS. The ability to specify the privileges has been in the content administration application for quite a while now, but the request handling code wasn't enforcing it at all. Now, when you request a section, SyntaxCMS will first check if the user has 'read' privileges to that section and all of its ancestors.
This means you can create a section called 'Member Only' and then create children sections beneath it. By just restricting access to the 'Member Only' section, you're also effectively restricting content to all of its descendants (not just its immediate children).
I also fixed a very broken getAncestorsCollection method in the SectionNavigator class and eliminated a lot of php notices as well.