[Asterisk-Users] Setting up Security Groups

[PA]

I appologize for the long, new-ish question, but after a few days of trying to work a solution by reading through the list archives and WIKI and coming up with what I thought would work, I think I'm just not getting a fine detail.  

I titled this thread "Setting up Security Groups" because I'm trying to set up some sip user groups with certain calling rights, e.g., one group of sip phones have the right to make any type of call.  another group of sip phones have the right to make local & toll free calls only.   

The outbound dialing is broken down into 4 contexts in extensions.conf; outbound-local, outbound-toll, outbound-tollfree, and outbound-longdistance.  

The sip users are set up in 3 contexts in extensions.conf; sip-superuser, sip-operator and sip-basic.  

Under default context in extensions.conf, I have an include statement for the outbound calling.  To make sure they all worked, originally I had the include statement for the sip user groups also under the default context.  Everyone could dial every type of call, which wasn't what I wanted, but at least I know that the outbound calling works.  

I then tried moving the include statements for outbound contexts into each sip user group.  Everyone can still dial outbound.

Right now here is how I have it structured in extensions.conf.  What am I missing?  Why would a sip-basic member be able to make toll calls?

[default]
include => sip-basic
include => sip-operator
include => sip-superuser

[sip-superuser]
include => outbound-local
include => outbound-longdistance
include => outbound-tollfree
include => outbound-toll
---> sip users info follows here

[sip-operator]
include => outbound-local
include => outbound-longdistance
include => outbound-tollfree
---> sip users info follows here

[sip-basic]
include => outbound-local
include => outbound-tollfree
---> sip users info follows here

[outbound-local]
---> outbound calling info follows here

[outbound-longdistance]
---> outbound calling info follows here

[outbound-tollfree]
---> outbound calling info follows here

[outbound-toll]
---> outbound calling info follows here