It’s hard to tell where you went wrong, but maybe this will help.
You need to give back-end users context access to the manage context so they can log in to the Manager, and context access to the web context so they can see that context at all in the tree. Once you’ve done that, however, you should try to forget about it and think of the web context as the front end and the mgr context as the back end. So any rules you create using the web context will only affect the front end and will not restrict access in the Manager and vice versa.
Context Access ACL entries (actually the attached policies) govern what a person can do in general (see resources, edit templates, add users, etc.) in that context (web or mgr). The policies should always be a subset of the Administrator policy.
Hiding selected resources in the Manager is *always* done with Resource Group Access ACL entries with a policy that’s some subset of the Resource policy and a context of mgr.
Hiding selected resources in the front end is *always* done with Resource Group Access ACL entries with a policy that’s some subset of the Resource policy and a context of web.
Resource Group Access policies govern what a user can do with the resources in that resource group in the specified context (e.g., see them, edit them, save them, etc.).
http://bobsguides.com/revolution-permissions.html (See especially the very last section, which is new.)
