[Building Sakai] Setting a resource's permissions

[Brian Baillargeon]

Hi all,

I'm working on a fork of the certification tool. I want the tool to save 
PDFs somewhere in the site's resources rather than root/certification/...
However, I don't want students to have any permissions to view/modify 
the template PDFs, so I want to disable all of the resource permissions 
(such as Create resources, Read resources...) on the related directories 
for roles who don't have certificate.admin permissions.

So for example, if we had
root/certification/templates/<siteId>/<certificateDefinitionId>/myPdf.pdf
In my implementation it should be somewhere like
<siteCollection>/certification/templates/<certificateDefinitionId>/myPdf.pdf
and the <siteCollection>/certification/templates/ folder's permissions 
would all be enabled for Instructor and disabled for Student

I've been poking around ContentHostingService, and I see ways to check 
for permissions but nothing to set them. I also poked around in 
AuthzGroupService, but didn't see how to use it with ContentResources.
Does anybody know a way to set permissions on a ContentCollection?

Thanks,
Brian