In general, don't modify the library-level privilege default settings. By default, all Records Manager privileges aren't granted. If you change this setting to granted by default, all users are automatically given this privilege.
NOTE: This should only be used if only a small subset of users must NOT have this privilege.

When users are included in multiple groups, we recommend that you avoid revoking privileges. Even if the user is Granted the privilege in another group, a Revoke always supersedes a Grant. Instead, use the Not Granted default value to prevent the user from performing the function.