I don't know for which part of the CMS you are talking but there are some areas where Elxis acts with its own intelligence to make things easier and more simple.
GROUP ACO ACO Value AXO AXO Valuemanager administration login NULL NULLmanager administration manage components com_frontpagemanager administration edit components com_frontpagemanager administration edit components com_mediamanager action add content allmanager action edit content allmanager administration install components allmanager action view profile allmanager action upload files imagesmanager action edit profile ownmanager action add weblinks allmanager administration manage components com_menumanagermanager administration manage components com_stargallerymanager administration edit components com_stargallerymanager action upload files allmanager administration edit components com_menumanagermanager administration manage components com_mediamanager administration manage components com_weblinksmanager administration edit components com_weblinksmanager administration edit modules all
<?php global $acl;$canpuball = $acl->acl_check('action', 'publish', 'users', $my->usertype, 'content', 'all');$canpubown = $acl->acl_check('action', 'publish', 'users', $my->usertype, 'content', 'own');$canpublish = 0;if (!$canpuball) { if ($canpubown && ($row->created_by == $my->id)) { $canpublish = $row->state; }} else { $canpublish = $row->state;}$row->state = $canpublish;?>
No one is allowed to edit published items from front-end. The "permissions" in the access manager are from the previous Elxis generation (2006.x) and have not been removed as they might be used for other purposes