Probably true that I don't understand the auth stuff very well. Do I use groups? Is that why each user has it's own unique group? Do I assign a write permission for a group on a specific and thus only that logged-in-user can edit the record?
There's some documentation like that when using CRUD but I'm probably not going to use CRUD since I'd like more flexibility. Would I still set it up like that, though? This would seem to be the heart of any application but it's hard to figure out how to implement (for me at least). Most of the examples I see seem to provide any logged in user with access to everything.

