...
root/ (default content roles, i.e. no roles for anyone)
├── object A (everyone => reader; johndoe => admin)
│ ├── datastream 1 (johndoe => admin)
│ └── object A Q (everyone => reader; johndoe => admin)
├── object B (everyone => reader; johndoe => admin)
└── object C
...