Restrict access to parent resources, allow children (in manager context)

Hi everyone!
I know, it was already asked 100 times, but I can't find any specific answer that can be applied to my question. First, yes, I admit, I don't understand how permissions system works
I have a typical resources setup:

I have to restrict editor access to anything except the whole Category three + Page 1.1 + Page 2.3 without allowing to edit parents of these pages — Home, Category one, Category two.
Any ideas what I should do?

Before, I had to allow access only to Category three, which I did by creating a Resource Group 'Restricted' (with Category two and Category three in there) and setting Minimum Role = 0(admin) to that Resource group in Resource Group Access settings in User Group: Content Manager settings (under Security → Access Controls → User Groups). So I was basically restricting access to restricted pages instead of granting access to allowed pages. But it's not gonna work now, when the task is changed as I described above.

Thanks a lot in advance to everyone!

I would first create a resource group called "all docs" and assign that to the super admin. I would then shove all of the website documents into this. This would then hide any resources from the content admin. Then I would create a resource group for the content admin and shove Category 3, Page 1.1 and Page 2.3 into that resource group and see what happens.

sonicpunk, thanks for your idea, but it's not working: content admin can't see any resources as soon as I put Home into 'All docs' and assign it to super admin.

after you create your resource groups - make sure that you added the content admin user group to the resource group.

Check out this tutorial. It will probably help you easier than someone posting here:

http://bmv-interactive.com/home/modx-acl-tutorial.html

Try this:

Put the parents in their own resource group.

Give the admin access to that Resource Group with a Resource Group Access ACL entry with a policy of Resource (context of mgr, minimum role or Super User).

Give everyone else access to that Resource Group by putting them in another group and creating a similar Resource Group Access ACL entry for that Resource Group, but with a policy of "Load, List, and View" (context of mgr, minimum role of member).

The non-admins should be able to see everything in the tree, but only edit the children.

I don't think you need the allDocs group unless you want to hide or limit access to all resources by default.