diff --git a/modules/themeroller/data/views/permissions_form.html.php b/modules/themeroller/data/views/permissions_form.html.php
index 91377536..5da1b5e6 100644
--- a/modules/themeroller/data/views/permissions_form.html.php
+++ b/modules/themeroller/data/views/permissions_form.html.php
@@ -11,8 +11,7 @@
 
     <? foreach ($permissions as $permission): ?>
     <tr>
-  <td> <?= t($permission->display_name) ?>
- </td>
+      <td> <?= t($permission->display_name) ?></td>
       <? foreach ($groups as $group): ?>
         <? $intent = access::group_intent($group, $permission->name, $item) ?>
         <? $allowed = access::group_can($group, $permission->name, $item) ?>
@@ -20,33 +19,64 @@
 
         <? if ($lock): ?>
           <td class="g-denied">
-            <a href="javascript:show(<?= $lock->id ?>)" title="<?= t('denied and locked through parent album, click to go to parent album')->for_html_attr() ?>"  class="ui-icon ui-icon-locked" />
+            <a href="javascript:return false;"
+               title="<?= t('denied and locked through parent album')->for_html_attr() ?>"
+               class="ui-icon ui-icon-cancel g-passive" />
+            <a href="javascript:show(<?= $lock->id ?>)"
+               title="<?= t('denied and locked through parent album, click to go to parent album')->for_html_attr() ?>"
+               class="ui-icon ui-icon-locked" />
           </td>
         <? else: ?>
           <? if ($intent === access::INHERIT): ?>
             <? if ($allowed): ?>
               <td class="g-allowed">
-                <a href="javascript:set('allow',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)" title="<?= t('allowed through parent album, click to deny')->for_html_attr() ?>" class="ui-icon ui-icon-check" />
+                <a href="javascript:set('allow',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
+                   title="<?= t('allowed through parent album, click to allow explicitly')->for_html_attr() ?>"
+                   class="ui-icon ui-icon-check" />
+                <a href="javascript:set('deny',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
+                   title="<?= t('click to deny')->for_html_attr() ?>"
+                   class="ui-disabled ui-icon ui-icon-cancel" />
               </td>
             <? else: ?>
               <td class="g-denied">
+                <a href="javascript:set('allow',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
+                  title="<?= t('click to allow')->for_html_attr() ?>"
+                   class="ui-icon ui-icon-check" />
                 <a href="javascript:set('deny',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
-                  title="<?= t('denied through parent album, click to allow')->for_html_attr() ?>"
-                 class="ui-icon ui-icon-cancel" />
-              </td>
+                   title="<?= t('denied through parent album, click to deny explicitly')->for_html_attr() ?>"
+                   class="ui-disabled ui-icon ui-icon-cancel" />
+             </td>
             <? endif ?>
 
           <? elseif ($intent === access::DENY): ?>
             <td class="g-denied">
               <a href="javascript:set('allow',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
-                title="<?= t('denied, click to allow')->for_html_attr() ?>"
-                 class="ui-icon ui-icon-cancel" />
+                title="<?= t('click to allow')->for_html_attr() ?>"
+                   class="ui-icon ui-icon-check" />
+              <? if ($item->id == 1): ?>
+              <a href="javascript:return false;"
+                 title="<?= t('denied')->for_html_attr() ?>"
+                 class="ui-icon ui-icon-cancel g-passive" />
+               <? else: ?>
+                <a href="javascript:set('reset',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
+                   title="<?= t('denied, click to reset')->for_html_attr() ?>"
+                   class="ui-icon ui-icon-cancel" />
+              <? endif ?>
             </td>
           <? elseif ($intent === access::ALLOW): ?>
             <td class="g-allowed">
-                <a href="javascript:set('deny',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
-                   class="ui-icon ui-icon-check"
-                  title="<?= t('allowed, click to deny')->for_html_attr() ?>" />
+              <? if ($item->id == 1): ?>
+              <a href="javascript:return false;"
+                 title="<?= t('allowed')->for_html_attr() ?>"
+                 class="ui-icon ui-icon-check g-passive" />
+              <? else: ?>
+              <a href="javascript:set('reset',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
+                 title="<?= t('allowed, click to reset')->for_html_attr() ?>"
+                 class="ui-icon ui-icon-check" />
+              <? endif ?>
+              <a href="javascript:set('deny',<?= $group->id ?>,<?= $permission->id ?>,<?= $item->id ?>)"
+                 title="<?= t('click to deny')->for_html_attr() ?>"
+                 class="ui-icon ui-icon-cancel" />
             </td>
           <? endif ?>
         <? endif ?>
diff --git a/modules/themeroller/views/site_screen.css.php b/modules/themeroller/views/site_screen.css.php
index 6cc543e2..0b5b90bb 100644
--- a/modules/themeroller/views/site_screen.css.php
+++ b/modules/themeroller/views/site_screen.css.php
@@ -433,14 +433,27 @@ td {
 
 .g-allowed a {
   background-image: url("themeroller/images/ui-icons_<?= $iconColorHighlight ?>_256x240.png") !important;
+  display:inline-block;
   margin: auto;
 }
 
 .g-denied a {
   background-image: url("themeroller/images/ui-icons_<?= $iconColorError ?>_256x240.png") !important;
+  display:inline-block;
   margin: auto;
 }
 
+.g-denied a.g-passive,
+.g-allowed a.g-passive {
+  filter:Alpha(Opacity=35);
+  opacity: .55;
+}
+
+#g-permissions .g-active a {
+  border: 1px solid #<?= $borderColorActive ?>;
+  background: #<?= $bgColorActive ?>;
+}
+
 /** *******************************************************************
  * 5) Navigation and menus
  *********************************************************************/