If hardlinks to non-writeable files are prohibitted, then the system
would prevent BetaReport from being updated except by people who are
in both "devel" and "prof", and from being read by anyone outside
"devel". Nested directories could be used to "and" group permission
requirements, and hard links could be used to "or" group permission
requirements.
As things currently stand, someone in "devel" can trivially give
write access to BetaReport to all people in "prof", even if the
intersection of devel and prof is but a small fraction of devel. The
system, as it currently stands, wouldn't even leave a record of who
did this.
So what?
Someone in Devel can trivial give write access to Beta Report merely by
leaving a setgid devel program in their homedirectory.
- Ted