Why are the results different on Permission Check for my Custom Application?

Are you on version 9?   There is no permission API that takes container Ids, its going to be the content or the application.   If you are on version 9 there is a secondary issue in the fact your version is not  supported any more and a new version of the permissions API was added in version 11.   I highly recommend upgrading

yes.. afraid I am on 9.x so... I keep telling my people... 
Looking forward to upgrading, hope your sales team is letting our leadership know we need to upgrade too.
we're up on our license, so there's not reason to not upgrade.

I totally get it.  I understand it maybe too much to ask. you already saved us with your last post. thank you for that.

The overloads allowed for 'entityId' and entityTypeId, and then the entityPermissionType is application or content, so I using the application enum value option.. 

I didn't know what an entity could be... 

since the method is check if the user can create an application, there is not an application Id yet.  But I'll try passing null values see if it's just the application enum value that returns true.

doesn't look like this IContent Get is implemented right.. it's returning a new map not the actual content.. that might be a different problem.

So, I implemented the ISecuredContentType like so (just guessing what the input needs to be):

public ISecuredContentType Get( IContent content) {   return content as ISecuredContentType; } 

So I think we need to really back up.   Get should be explicit  as in 

IContent ISecuredContentType.Get(Guid contentId) {}

This might help as a starting point:  The Content Model  

the content model is implemented for the application and the content.. the container is always the group,.. 

public class MapAppType : IPlugin, IConfigurablePlugin, IApplicationType, IManageableApplicationType, IApplicationNavigable, INavigableApplicationType, ICategorizedPlugin, IWebContextualApplicationType

public class MapContentType : IPlugin, IContentType, IWebContextualContentType, INavigable, ISecuredContentType 

Below image shows the management panel with the application

the map application type

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Web;
using Telligent.DynamicConfiguration.Components;
using Telligent.Evolution.Extensibility;
using Telligent.Evolution.Extensibility.Api.Version1;
using Telligent.Evolution.Extensibility.Content.Version1;
using Telligent.Evolution.Extensibility.Urls.Version1;
using TeUrls = Telligent.Evolution.Extensibility.Urls;
using Telligent.Evolution.Extensibility.Version1;
using Telligent.Evolution.Extensibility.Api.Entities.Version1;
using TEApis = Telligent.Evolution.Extensibility.Apis;
using TEApi = Telligent.Evolution.Extensibility.Api.Version1.PublicApi;
using TeUi = Telligent.Evolution.Extensibility.UI.Version1;
using System.Windows.Automation;
using CommunityMap.InternalApi.Entities;
using Telligent.Evolution.Extensibility.Security.Version1;

namespace CommunityMap.Plugins.Applications
{
    public class MapAppType : IPlugin, IConfigurablePlugin, IApplicationType, IManageableApplicationType, IApplicationNavigable, INavigableApplicationType, ICategorizedPlugin, IWebContextualApplicationType
    {
        IApplicationStateChanges _applicationState = null;
        PermissionType _entityPermissionType = PermissionType.Application;
        public static Guid _applicationTypeId = new Guid("bfdb6103-e8e5-4cbf-8fbf-42dbac4046ef");
        protected internal static Guid _protectedApplicationTypeId = new Guid("bfdb6103-e8e5-4cbf-8fbf-42dbac4046ef");
        #region IPlugin
        public string Name => "Map App";
        public string Description => "Apan Community Map application type";
        public void Initialize() { }
        #region IApplicationType
        public string ApplicationTypeName =>  "Map App";
        public static string _ApplicationTypeName => "Map App";
        public Guid ApplicationTypeId => _applicationTypeId;
        public Guid[] ContainerTypes => new Guid[] { Apis.Get<IGroups>().ContainerTypeId };
        public void AttachChangeEvents(IApplicationStateChanges stateChanges) { _applicationState = stateChanges; }
        public IApplication Get(Guid applicationId) { 
            IApplication mapApp = PublicApi.MapApps.Get(applicationId);
            //TODO: figure out application securable Id 
            PluginManager.Get<UI.Permissions.MapAppPermissionRegistrar>().FirstOrDefault().RegisterApplicationSecurableId(applicationId, mapApp.Container.ContainerId);
            
            return mapApp;
        }      

        #endregion IApplicationType
        #endregion IPlugin
        #region IConfigurablePlugin
        public PropertyGroup[] ConfigurationOptions {
            get
            {
                PropertyGroup MapApis = new PropertyGroup("MapApi2s", "Map APIs2", 10);//tab 1 ui
                MapApis.Properties.Add(new Property("arcGisVersion2", "ArcGis Version2", PropertyType.String, 101, "4.0") { DescriptionText = "ArcGIS API Version, example: 4.0 " });

                return new PropertyGroup[] { MapApis };
            }
        }

        public void Update(IPluginConfiguration configuration)
        {
            //throw new NotImplementedException();
        }
        #endregion IConfigurablePlugin

        #region IManageableApplicationType


        public bool CanCreate(int userId, Guid containerTypeId, Guid containerId){
            
            Guid gapplicationId = Apis.Get<IGroups>().Get(containerId).ApplicationId;
            //var groupapp = Apis.Get<IGroups>()
            //PermissionCheck check1 = TEApi.Permissions.Get(UI.Permissions.MapAppPermissionRegistrar.DeleteGroupMapApps, userId);
            Guid permissionId = UI.Permissions.MapAppPermissionRegistrar.CreateGroupMapApps;
            Guid applicationId = new Guid();
             
            PermissionEntry nodeCheck = TEApi.NodePermissions.Get(permissionId.ToString());   
            PermissionEntry nodeCheck1 = TEApi.NodePermissions.Get("groups", gapplicationId, permissionId.ToString());
            PermissionEntry nodeCheck2 = TEApi.NodePermissions.Get("Map App", applicationId, permissionId.ToString());
            PermissionEntry nodeCheck3 = TEApi.NodePermissions.Get("mapapps", applicationId, permissionId.ToString());
                         
            PermissionCheck check1 = TEApi.Permissions.Get(permissionId, userId);
            PermissionCheck check2 = TEApi.Permissions.Get(permissionId, userId, containerId, containerTypeId,  _entityPermissionType);  
            PermissionCheck check3 = TEApi.Permissions.Get(permissionId, userId, applicationId, ApplicationTypeId, _entityPermissionType);


            return nodeCheck1.IsAllowed; // nodeCheck.IsAllowed; //|| check2.IsAllowed ;  
            
        }

        public bool CanDelete(int userId, Guid applicationId)
        {
            
                
            IApplication mapApp = PublicApi.MapApps.Get(applicationId);
            if (mapApp == null) return false;
            Guid containerId = mapApp.Container.ContainerId;
            Guid gapplicationId = Apis.Get<IGroups>().Get(containerId).ApplicationId; 
            Guid permissionId = UI.Permissions.MapAppPermissionRegistrar.DeleteGroupMapApps; 

            PermissionCheck check1 = TEApi.Permissions.Get(permissionId, userId);
            PermissionCheck check2 = TEApi.Permissions.Get(permissionId, userId, applicationId, mapApp.ApplicationTypeId, _entityPermissionType);

            PermissionEntry nodeCheck = TEApi.NodePermissions.Get(permissionId.ToString());
            PermissionEntry nodeCheck1 = TEApi.NodePermissions.Get("groups", gapplicationId, permissionId.ToString());
            PermissionEntry nodeCheck2 = TEApi.NodePermissions.Get("Map App", applicationId, permissionId.ToString());
            PermissionEntry nodeCheck3 = TEApi.NodePermissions.Get("mapapps", applicationId, permissionId.ToString());
            return nodeCheck1.IsAllowed;
        
        }


        public bool CanEdit(int userId, Guid applicationId)
        {
            IApplication mapApp = PublicApi.MapApps.Get(applicationId);
            if (mapApp == null) return false;
            Guid containerId = mapApp.Container.ContainerId;
            Guid gapplicationId = Apis.Get<IGroups>().Get(containerId).ApplicationId;
            Guid permissionId = UI.Permissions.MapAppPermissionRegistrar.UpdateGroupMapApps;


            PermissionCheck check1 = TEApi.Permissions.Get(permissionId, userId);
            PermissionCheck check2 = TEApi.Permissions.Get(permissionId, userId, applicationId, mapApp.ApplicationTypeId, _entityPermissionType);

            PermissionEntry nodeCheck = TEApi.NodePermissions.Get(permissionId.ToString());
            PermissionEntry nodeCheck1 = TEApi.NodePermissions.Get("groups", gapplicationId, permissionId.ToString());
            PermissionEntry nodeCheck2 = TEApi.NodePermissions.Get("Map App", applicationId, permissionId.ToString());
            PermissionEntry nodeCheck3 = TEApi.NodePermissions.Get("mapapps", applicationId, permissionId.ToString());
            return nodeCheck1.IsAllowed;
        }

        public bool CanSetEnabled(int userId, Guid applicationId)
        {
            IApplication mapApp = PublicApi.MapApps.Get(applicationId);
            if (mapApp == null) return false;
            Guid containerId = mapApp.Container.ContainerId;
            Guid gapplicationId = Apis.Get<IGroups>().Get(containerId).ApplicationId; 
            Guid permissionId = UI.Permissions.MapAppPermissionRegistrar.EnableGroupMapApps;


            PermissionCheck check1 = TEApi.Permissions.Get(permissionId, userId);
            PermissionCheck check2 = TEApi.Permissions.Get(permissionId, userId, applicationId, mapApp.ApplicationTypeId, _entityPermissionType);

            PermissionEntry nodeCheck = TEApi.NodePermissions.Get(permissionId.ToString());
            PermissionEntry nodeCheck1 = TEApi.NodePermissions.Get("groups", gapplicationId, permissionId.ToString());
            PermissionEntry nodeCheck2 = TEApi.NodePermissions.Get("Map App", applicationId, permissionId.ToString());
            PermissionEntry nodeCheck3 = TEApi.NodePermissions.Get("mapapps", applicationId, permissionId.ToString());
            return nodeCheck1.IsAllowed;
            
        }

        //1) can userId create application? anyone for now
        //2) what containerTypes are supported? just group containers for now
        //3) containerId is the group Guid, or any other application that has a nodeId
        //4) configurationDatabase is the properties set in the panel used to create the application

        public IApplication Create(int userId, Guid containerTypeId, Guid containerId, ConfigurationDataBase createConfigurationData)
        {
             
                
           
            try
            {
                foreach (Guid _containerTypeId in ContainerTypes)
                {
                    //container types for groups is 
                    if (Apis.Get<IGroups>().ContainerTypeId == _containerTypeId)
                    {
                        int groupId = Apis.Get<IGroups>().Get(containerId).Id.Value;
                        InternalApi.Entities.VerintMapApp verintMapApp = new InternalApi.Entities.VerintMapApp();
                        verintMapApp.ApplicationId = Guid.NewGuid();
                        verintMapApp.ApplicationTypeId = MapAppType._applicationTypeId;
                        verintMapApp.AvatarUrl = createConfigurationData.GetStringValue("mapAppAvatarUrl", "/cfs-filesystemfile/__key/system/images/grid.svg");
                        verintMapApp.Name = createConfigurationData.GetStringValue("mapAppName", "Map App");
                        verintMapApp.GroupId = groupId;
                        verintMapApp.IsEnabled = createConfigurationData.GetBoolValue("mapAppIsEnabled", true);
                        verintMapApp.Id = 0; 
                        verintMapApp.Description = createConfigurationData.GetStringValue("mapAppDesc", "The Map App contains Maps");
                        verintMapApp.Url = createConfigurationData.GetStringValue("mapAppUrl", "mapApps");
                        verintMapApp.SafeName = createConfigurationData.GetStringValue("safeNameUrl", verintMapApp.ApplicationId.ToString());
                        //verintMapApp.SafeName = createConfigurationData.GetStringValue("mapAppUrl", "mapApp");

                        verintMapApp = InternalApi.VerintDataService.CreateUpdateMapApp(verintMapApp);
                        //TODO: figure out application secuarable id
                         PluginManager.Get<UI.Permissions.MapAppPermissionRegistrar>().FirstOrDefault().RegisterApplicationSecurableId(verintMapApp.ApplicationId, containerId);
                        return PublicApi.MapApps.Get(verintMapApp.Id);

                    }
                    if (Apis.Get<IUsers>().ContainerTypeId == _containerTypeId)
                    {
                        //TODO: implement user's map applications
                        return null;
                    }
                }
            }
            catch (Exception ex)
            {
                //IUserRenderableException.
                string exceptions = ex.Message;
                throw;
            }
            return null;
        }

        /**TODO: functional programming to delete application**/
        // Func<int, Guid> deleteMap = (VerintMapApp fromVerintMapApp) => ToMapApp(fromVerintMapApp, new MapApp());
        // Func<MapApp, VerintMapApp> toVerintMapApp = (MapApp fromMapApp) => ToVerintMapApp(fromMapApp, new VerintMapApp());

        public void Delete(int userId, Guid applicationId) => InternalApi.VerintDataService.DeleteVerintMapAppApplication( applicationId);
         
        public PropertyGroup[] GetCreateConfiguration(int userId, Guid containerTypeId, Guid containerId)
        {
            PropertyGroup mapApp = new PropertyGroup("MapApp", "Option", 1);
            mapApp.Properties.Add(new Property("mapAppName", "Name", PropertyType.String, mapApp.Properties.Count, "Map App") { DescriptionText = "Title of the Map App" });
            mapApp.Properties.Add(new Property("mapAppDesc", "Description", PropertyType.String, mapApp.Properties.Count, "An app for mapping") { DescriptionText = "Description about the Map App" });
            mapApp.Properties.Add(new Property("mapAppAvatarUrl", "Avatar URL", PropertyType.String, mapApp.Properties.Count, "/cfs-filesystemfile/__key/system/images/grid.svg") { DescriptionText = "Map App Avatar's Url to svg or image" });
            mapApp.Properties.Add(new Property("mapAppIsEnabled", "Is Enabled", PropertyType.Bool, mapApp.Properties.Count, "true") { DescriptionText = "Map App is enabled after creating" });
            mapApp.Properties.Add(new Property("mapAppUrl", "URL name of mapapps list", PropertyType.String, mapApp.Properties.Count, "mapapp") { DescriptionText = "URL name to optimize Map App searching" });
            mapApp.Properties.Add(new Property("safeNameUrl", "URL safe name", PropertyType.String, mapApp.Properties.Count, "mapapp") { DescriptionText = "unique key name" });

            Property apiProperty = new Property("defaultApi", "Default Esri Mapping Api", PropertyType.String, mapApp.Properties.Count, "EsriMaps") { DescriptionText = "New Maps will use this api by default." };
            apiProperty.SelectableValues.Add(new PropertyValue("none", System.Web.HttpUtility.HtmlEncode("raw information for debugging"), apiProperty.SelectableValues.Count));
            apiProperty.SelectableValues.Add(new PropertyValue("EsriMaps", System.Web.HttpUtility.HtmlEncode("ArcGIS JavaScript Api"), apiProperty.SelectableValues.Count));
            
            mapApp.Properties.Add(apiProperty);

            //PropertyGroup mapApp2 = new PropertyGroup("MapApp2", "Setup", 2);
            //mapApp2.Properties.Add(new Property("name", "name", PropertyType.String, mapApp2.Properties.Count, "more options") { DescriptionText = "more descriptions" });

            return new PropertyGroup[] { mapApp };
        }



        public IList<IApplication> List(int userId, Guid containerTypeId, Guid containerId)
        {
            IList<IApplication> mapapps = new List<IApplication>();
            // IList<PublicApi.Entity.MapApp> mapapps = new List<PublicApi.Entity.MapApp>();
            foreach (Guid _containerTypeId in ContainerTypes)
            {
                var canRead = TEApi.Permissions.Get(UI.Permissions.MapAppPermissionRegistrar.ReadGroupMapApps, userId);
                //container types for groups is 
                if (canRead.IsAllowed && Apis.Get<IGroups>().ContainerTypeId == _containerTypeId)
                {
                    int groupId = Apis.Get<IGroups>().Get(containerId).Id.Value;

                    mapapps = PublicApi.MapApps.GetMapAppApplicationsByGroup(groupId);
                }
                if (Apis.Get<IUsers>().ContainerTypeId == _containerTypeId)
                {
                    //TODO: implement user's map applications
                    return mapapps;
                }
            }


            return mapapps;//.Cast<IApplication>().ToList(); ;
        }


        public IList<IApplication> Search(int userId, Guid containerTypeId, Guid containerId, string searchText)
        {
            IList<IApplication> mapapps = new List<IApplication>();
            return mapapps;
        }
    public void SetEnabled(int userId, Guid applicationId, bool enabled) => InternalApi.VerintDataService.MapApp_SetEnabled(userId, applicationId, enabled);
        #endregion IManageableApplicationType

        #region IApplicationNavigable
        Guid IApplicationNavigable.ApplicationTypeId { get { return this.ApplicationTypeId ; } }

        public string[] Categories
        {
            get
            {
                return new string[] { "MapApps" }; // TODO: Categories? Community Map
            }
        }
        #region INavigableApplicationType
        public string PathDelimiter
        {
            get { return "mapapps"; }
        }
        #endregion
        public void RegisterUrls(IUrlController controller)
        {
             
            controller.AddPage("GroupMapAppList", "", new Telligent.Evolution.Urls.Routing.NotSiteRootRouteConstraint(), null, "mapapp-list-page", MapApps_PdOptions);
            controller.AddPage("GroupMapAppSingle", "{mapAppSafeName}/maps", new Telligent.Evolution.Urls.Routing.NotSiteRootRouteConstraint(), null, "mapapp-map-list-page", MapApp_PdOptions);
            controller.AddPage("GroupMap", "{mapAppSafeName}/maps/{mapId}", new Telligent.Evolution.Urls.Routing.NotSiteRootRouteConstraint(), null, "mapapp-map-page", Map_PdOptions);
            controller.AddPage("GroupMapEdit", "{mapAppSafeName}/maps/{mapId}/edit", new Telligent.Evolution.Urls.Routing.NotSiteRootRouteConstraint(), null, "mapapp-map-edit-page", Map_Edit_PdOptions);


        }
        private PageDefinitionOptions Map_PdOptions
        {
            get
            {
                return new PageDefinitionOptions()
                {
                    ForceLowercaseUrl = true,
                    HasApplicationContext = true,
                    ParseContext = new Action<PageContext>(this.ParseMap_Context)
                    // This"validate" was in the documentation, but not sure why it's needed
                    // need to research this before enabling it.
                    // Validate = new Action<PageContext, IUrlAccessController>(Validate)
                };
            }
        }
        private PageDefinitionOptions Map_Edit_PdOptions
        {
            get
            {
                return new PageDefinitionOptions()
                {
                    ForceLowercaseUrl = true,
                    HasApplicationContext = true,
                    ParseContext = new Action<PageContext>(this.ParseMapEdit_Context)
                    // This"validate" was in the documentation, but not sure why it's needed
                    // need to research this before enabling it.
                    // Validate = new Action<PageContext, IUrlAccessController>(Validate)
                };
            }
        }
        private void ParseMapEdit_Context(PageContext pageContext)
        {
            // TODO: Refactor so there is one method that does samething
            //ParseMapApp_Context(pageContext);
            var allContext = pageContext.ContextItems.GetAllContextItems();
            var cnt = allContext.Count;
            int groupId = -1;
            for (int i = 0; i < cnt; i++)
            {
                var typename = allContext[i].TypeName;
                Guid appId = allContext[i].ApplicationId.Value;
                if (typename != "Group" || true)
                {


                    if (!int.TryParse(allContext[0].Id, out groupId)) { }
                    string singleMapApp = pageContext.GetTokenValue("mapAppSafeName") as string;
                    string singleMap = pageContext.GetTokenValue("mapId") as string;
                    Guid appId2 = allContext[0].ApplicationId.Value;
                    Guid mapId;
                    Guid mapAppId = appId2;
                    if (!Guid.TryParse(singleMap, out mapId)) { throw new ArgumentException("...maps/{ID} is required."); }
                    //if (!Guid.TryParse(singleMapApp, out mapAppId)) { throw new ArgumentException("...mapapps/{ID} is required."); }
                    if (groupId > -1)
                    {
                        var group = TEApi.Groups.Get(new GroupsGetOptions { Id = groupId });
                        ContextItem contextItem = new ContextItem();
                        if (!string.IsNullOrEmpty(singleMapApp))
                        {
                            //PublicApi.Entities.MapApp mapapp2 = new PublicApi.Entities.MapApp(InternalApi.VerintDataService.GetVerintMapAppApplication(appId));
                            PublicApi.Entities.MapApp mapapp = InternalApi.VerintDataService.GetMapAppByGroupId_Name(groupId, "mapapp", singleMapApp);
                            PublicApi.Entities.Map map = new PublicApi.Entities.Map(InternalApi.VerintDataService.GetVerintMap(mapId));

                            contextItem.ApplicationId = mapapp.ApplicationId;
                            contextItem.ApplicationTypeId = mapapp.ApplicationTypeId;
                            contextItem.ContainerId = mapapp.Container.ContainerId;
                            contextItem.ContainerTypeId = mapapp.Container.ContainerTypeId;
                            contextItem.ContentId = mapapp.ApplicationId;
                            contextItem.ContentTypeId = mapapp.ApplicationTypeId;
                            contextItem.TypeName = _ApplicationTypeName; //why would this not be Map 
                            //contextItem.Id = map.Id.ToString();
                            contextItem.Id = mapapp.Group.Id.Value.ToString();
                            //pageContext.ContextItems.Put(contextItem);
                            contextItem.ContentId = map.ContentId;
                            contextItem.ContentTypeId = map.ContentTypeId;
                            contextItem.TypeName = "Map";



                        }
                        pageContext.ContextItems.Put(contextItem);
                    }

                }
            }


        }
        //private PageDefinitionOptions Map_PdOptions
        //{
        //    get
        //    {
        //        return new PageDefinitionOptions()
        //        {
        //            ForceLowercaseUrl = true,
        //            HasApplicationContext = true,
        //            ParseContext = new Action<PageContext>(this.ParseMapApp_Context)
        //            Validate = new Action<PageContext, IUrlAccessController>(Validate)
        //        };
        //    }
        //}
        private void ParseMap_Context(PageContext pageContext)
        {
            // TODO: Refactor so there is one method that does samething
            //ParseMapApp_Context(pageContext);
            var allContext = pageContext.ContextItems.GetAllContextItems();
            var cnt = allContext.Count;
            int groupId = -1;
            for (int i = 0; i < cnt; i++)
            {
                var typename = allContext[i].TypeName;
                Guid appId = allContext[i].ApplicationId.Value;
                if (typename != "Group" || true)
                {


                    if (!int.TryParse(allContext[0].Id, out groupId)) { }
                    string singleMapApp = pageContext.GetTokenValue("mapAppSafeName") as string;
                    string singleMap = pageContext.GetTokenValue("mapId") as string;
                    Guid appId2 = allContext[0].ApplicationId.Value;
                    Guid mapId;
                    Guid mapAppId = appId2;
                    if (!Guid.TryParse(singleMap, out mapId)) { throw new ArgumentException("...maps/{ID} is required."); }
                    //if (!Guid.TryParse(singleMapApp, out mapAppId)) { throw new ArgumentException("...mapapps/{ID} is required."); }
                    if (groupId > -1)
                    {
                        var group = TEApi.Groups.Get(new GroupsGetOptions { Id = groupId });
                        ContextItem contextItem = new ContextItem();
                        if (!string.IsNullOrEmpty(singleMapApp))
                        {
                            //PublicApi.Entities.MapApp mapapp2 = new PublicApi.Entities.MapApp(InternalApi.VerintDataService.GetVerintMapAppApplication(appId));
                            PublicApi.Entities.MapApp mapapp = InternalApi.VerintDataService.GetMapAppByGroupId_Name(groupId, "mapapp", singleMapApp);
                            PublicApi.Entities.Map map = new PublicApi.Entities.Map(InternalApi.VerintDataService.GetVerintMap(mapId));

                            contextItem.ApplicationId = mapapp.ApplicationId;
                            contextItem.ApplicationTypeId = mapapp.ApplicationTypeId;
                            contextItem.ContainerId = mapapp.Container.ContainerId;
                            contextItem.ContainerTypeId = mapapp.Container.ContainerTypeId;  
                            contextItem.ContentId = mapapp.ApplicationId;
                            contextItem.ContentTypeId = mapapp.ApplicationTypeId;
                            contextItem.TypeName = _ApplicationTypeName; //why would this not be Map 
                            //contextItem.Id = map.Id.ToString();
                            contextItem.Id = mapapp.Group.Id.Value.ToString();
                            //pageContext.ContextItems.Put(contextItem);
                            //contextItem.ContentId = map.ContentId;
                            //contextItem.ContentTypeId = map.ContentTypeId;
                            //contextItem.TypeName = "Map";



                        }
                        pageContext.ContextItems.Put(contextItem);
                    }

                }
            }


        }
        private PageDefinitionOptions MapApps_PdOptions
        {
            get
            {
                return new PageDefinitionOptions()
                {
                    ForceLowercaseUrl = true,
                    HasApplicationContext = true,
                    //TODO: if the map management panel is needed a this URL,
                    //      ParseContext is need, otherwise, no action is needed.
                    //ParseContext = new Action<PageContext>(this.ParseMapApps_Context)
                    //Validate = new Action<PageContext, IUrlAccessController>(Validate)
                };
            }
        }
        private PageDefinitionOptions MapApp_PdOptions
        {
            get
            {
                return new PageDefinitionOptions()
                {
                    ForceLowercaseUrl = true,
                    HasApplicationContext = true,
                    ParseContext = new Action<PageContext>(this.ParseMapApp_Context)
                    //Validate = new Action<PageContext, IUrlAccessController>(Validate)
                };
            }
        }



        private void MapAppAction(HttpContextBase arg1, PageContext arg2)
        {
            //throw new NotImplementedException();
        }
        private ContextItem BuildUserContextItem(Telligent.Evolution.Extensibility.Api.Entities.Version1.User user)
        {
            var item = new ContextItem()
            {
                TypeName = "User",
                ApplicationId = user.ContentId,
                ApplicationTypeId = TEApi.Users.ContentTypeId,
                ContainerId = user.ContentId,
                ContainerTypeId = TEApi.Users.ContentTypeId,
                ContentId = user.ContentId,
                ContentTypeId = TEApi.Users.ContentTypeId,
                Id = user.Id.ToString()
            };
            return item;
        }

        private void ParseMapApps_Context(PageContext pageContext)
        {
            
            var ApplicationId = pageContext.GetTokenValue("ApplicationId");
            var ApplicationTypeId = pageContext.GetTokenValue("ApplicationTypeId");
            var allContext = pageContext.ContextItems.GetAllContextItems();
            var cnt = allContext.Count;
            int groupId = -1;
            var applicationId = allContext[0].ApplicationId.Value;
            var applicationTypeId = allContext[0].ApplicationTypeId.Value;
            var containerId = allContext[0].ContainerId.Value;
            var contrainerTypeId = allContext[0].ContainerTypeId;
            var contenId = allContext[0].ContentId.Value;
            var contentTypeId = allContext[0].ContentTypeId.Value;
            var typeNameId = allContext[0].Id;
            var relationship = allContext[0].Relationship;
            var typename = allContext[0].TypeName;
            var hashCode = allContext[0].GetHashCode();


            if (!int.TryParse(allContext[0].Id, out groupId))
            {
                //if groupid is not 
                // find by  mapApp name only... 
                // TODO: optimize database with safeName and GroupId indexing
            }

            IList<PublicApi.Entities.MapApp> mapApps = new List<PublicApi.Entities.MapApp>();

            if (groupId > -1)
            {
                var group = TEApi.Groups.Get(new GroupsGetOptions { Id = groupId });
                ContextItem contextItem = new ContextItem();

                try
                {
                    if (groupId >= 0)
                    {
                        mapApps = PublicApi.MapApps.List(groupId);
                        if (mapApps != null)
                        {
                            if (mapApps.Count == 1)
                            {
                               contextItem.ApplicationId = mapApps[0].ApplicationId;
                               contextItem.ContentId = mapApps[0].ApplicationId;
                            }

                            contextItem.ContainerId = mapApps[0].Container.ContainerId;
                            contextItem.ContainerTypeId = mapApps[0].Container.ContainerTypeId;    //Apis.Get<IGroups>().ContainerTypeId,  

                            contextItem.ContentTypeId = mapApps[0].ApplicationTypeId;
                            contextItem.TypeName = _ApplicationTypeName;
                            contextItem.Id = mapApps[0].Group.Id.Value.ToString();

                        }
                        contextItem.TypeName = _ApplicationTypeName;
                        contextItem.ApplicationTypeId = this.ApplicationTypeId;
                    }
                }
                catch (Exception ex)
                {
                    var message = ex.Message;
                    //throw;
                }
                 
                pageContext.ContextItems.Put(contextItem);
            }
        }
        private void ParseMapApp_Context(PageContext pageContext)
        {
            var allContext = pageContext.ContextItems.GetAllContextItems();
            var cnt = allContext.Count;
            int groupId = -1;
            var typename = allContext[0].TypeName;
            Guid appId = allContext[0].ApplicationId.Value;
            if (!int.TryParse(allContext[0].Id, out groupId))
            {

            }
            string singleMapApp = pageContext.GetTokenValue("mapAppSafeName") as string;

            if (groupId > -1)
            {
                var group = TEApi.Groups.Get(new GroupsGetOptions { Id = groupId });
                ContextItem contextItem = new ContextItem();
                if (!string.IsNullOrEmpty(singleMapApp))
                {
                    PublicApi.Entities.MapApp mapapp = InternalApi.VerintDataService.GetMapAppByGroupId_Name(groupId, "mapApps", singleMapApp);
                    //VerintMapApp mapapp2 = InternalApi.VerintDataService.GetVerintMapAppApplication(mapApp.ApplicationId);

                    contextItem.ApplicationId = mapapp.ApplicationId;
                    contextItem.ApplicationTypeId = mapapp.ApplicationTypeId;
                    contextItem.ContainerId = mapapp.Container.ContainerId;
                    contextItem.ContainerTypeId = mapapp.Container.ContainerTypeId;    //Apis.Get<IGroups>().ContainerTypeId,  
                    contextItem.ContentId = mapapp.ApplicationId;
                    contextItem.ContentTypeId = mapapp.ApplicationTypeId;
                    contextItem.TypeName =   _ApplicationTypeName;
                    contextItem.Id = group.Id.HasValue ? group.Id.Value.ToString() : "" ;// mapapp.Group.Id.Value.ToString();

                }
                pageContext.ContextItems.Put(contextItem);
            }


        }
        #endregion
        #region IWebContext

        bool IWebContextualApplicationType.IsCurrentApplicationType(TeUi.IWebContext context)
        {
            bool isCurrentMapAppType = false;
            bool maybeMapAppTypes = (context.Url.Contains("/mapapps/")) ? true : false;
            //to be current Application requires "/mapapps/" maybe it is
            bool maybeCurrentMapAppType = (!context.Url.Contains("/maps/") && maybeMapAppTypes) ? true : false;
            //if the url doesn't end with 
            
            if (TEApi.Url.CurrentContext != null && maybeCurrentMapAppType)
            {
                var item = TEApi.Url.CurrentContext.ContextItems.Find(c => c.ApplicationTypeId.Value == ApplicationTypeId);//.GetAllContextItems();
                isCurrentMapAppType = (item != null && item.ApplicationId.HasValue) ? true : false;
            }
            return isCurrentMapAppType;
        }
        public IApplication GetCurrentApplication(TeUi.IWebContext context)
        {
            PublicApi.Entities.MapApp mapApp = new PublicApi.Entities.MapApp();
            IApplication app = mapApp as IApplication;

            if (TEApi.Url.CurrentContext == null) return app;
            var item = TEApi.Url.CurrentContext.ContextItems.Find(c => c.ApplicationTypeId.Value == ApplicationTypeId);//.GetAllContextItems();
            if (item != null && item.ApplicationId.HasValue) { return PublicApi.MapApps.Get(item.ApplicationId.Value); }

            return app;
        }



        #endregion


    }
}

namespace CommunityMap.Plugins.Contents
{
    using System;
   
    using System.Collections.Generic;
    using System.Linq;
    using System.Text;
    using System.Threading.Tasks;
     
    using Telligent.Evolution.Extensibility.Content.Version1;
    using Telligent.Evolution.Extensibility.Version1;
    using TeUi = Telligent.Evolution.Extensibility.UI.Version1;
    using Telligent.DynamicConfiguration.Components;
    using Telligent.Evolution.Urls.Routing;


    using Telligent.Evolution.Extensibility;
    using Telligent.Evolution.Extensibility.Api.Version1;

    using Telligent.Evolution.Extensibility.Urls.Version1;
    using TeUrls = Telligent.Evolution.Extensibility.Urls;

    using TEApi = Telligent.Evolution.Extensibility.Api.Version1.PublicApi;
    using PublicApi = CommunityMap.PublicApi;
    using CommunityMap.Plugins.Applications;

    public class MapContentType : IPlugin, IContentType, IWebContextualContentType, INavigable, ISecuredContentType //, ICategorizedPlugin
    /* TODO: , ITranslatablePlugin, IPermissions , ITaggableContentType, ISearchableContentType,  
     *  IScriptedContentFragmentExtension, 
     *  IGroupNewPostLinkPlugin
     *  
     */
    {
        // ITranslatablePluginController _translation;
        IContentStateChanges _contentState;
        //IHashTagController _hashTagController;
        //IMentionController _mentionController;
        string ApplicationTypeName = MapAppType._ApplicationTypeName;

        public Guid[] ApplicationTypes { get { return new Guid[] { Plugins.Applications.MapAppType._applicationTypeId }; } }


        public static readonly Guid _contentTypeId = new Guid("8acb93a7-f580-4c23-95c8-98ad8cf94d45");
        public Guid ContentTypeId { get { return _contentTypeId; } }
        public string ContentTypeName { get { return "MapContent"; } }

        public string Description { get { return "Community Map Content"; } }

        public string Name { get { return "Map"; } }

        public void AttachChangeEvents(IContentStateChanges stateChanges) { _contentState = stateChanges; }

        public IContent Get(Guid contentId) { PublicApi.Entities.Map map = new PublicApi.Entities.Map(); return map; }

        public ISecuredContentType Get( IContent content) {   return content as ISecuredContentType; } 
        //public IContent GetCurrentContent(TeUi.IWebContext context)
        //{
        //    IContent cont = new  PublicApi.Map() as IContent;
        //    return cont;
        //   // throw new NotImplementedException();
        //}

        public void Initialize() { }



        #region IWebContextualContentType Members

        public IContent GetCurrentContent(TeUi.IWebContext context)
        {
            if (TEApi.Url.CurrentContext == null || context.Url.IndexOf("/mapapps/") == -1 || context.Url.IndexOf("/maps/") == -1) return null;
            Guid applicationTypeId = Plugins.Applications.MapAppType._applicationTypeId;
            //IEnumerable<IContextItem> items = TEApi.Url.CurrentContext.ContextItems.Find(c => c.ApplicationTypeId.Value == applicationTypeId));
            IEnumerable<IContextItem> items = TEApi.Url.CurrentContext.ContextItems.GetAllContextItems().Where(c => c.ApplicationTypeId.Value == applicationTypeId);//c.ContentTypeId == PublicApi.Maps.ContentTypeId);
            if (items.Count() == 1)
            {

                IContextItem item = items.Single();

                PublicApi.Entities.Map content = CommunityMap.PublicApi.Maps.Get(item.ContentId.Value);
                if (content != null && content.ContentId != Guid.Empty)
                {
                    return content;
                }
                else
                {

                    //return null; this block may not be needed if the contentid is not a map 
                    //and the url is for a mapapp, not a map.

                    int start = context.Url.IndexOf("/maps/") + 5;
                    int urlLen = context.Url.Length;
                    string guidStr = ((urlLen - start) == 32) ? context.Url.Substring(start, 32) : "";
                    Guid contentId = Guid.TryParse(guidStr, out contentId) ? contentId : Guid.Empty;
                    content = PublicApi.Maps.Get(contentId);
                    return content;
                }
            }

            return null;
        }

        #endregion

        #region ICategorizedPlugin Members

        public string[] Categories
        {
            get
            {
                return new string[] { "Verint" };
            }
        }
        #endregion
        #region INavigable Members
        public string PathDelimiter
        {
            get { return "mapapps"; }
        }
        public void RegisterUrls(IUrlController controller)
        {
            controller.AddPage("GroupMapEdit", "{mapAppSafeName}/maps/{mapId}/edit/", new Telligent.Evolution.Urls.Routing.NotSiteRootRouteConstraint(), null, "apan-map-page", Map_PdOptions);

        }
        private PageDefinitionOptions Map_PdOptions
        {
            get
            {
                return new PageDefinitionOptions()
                {
                    ForceLowercaseUrl = true,
                    HasApplicationContext = true,
                    ParseContext = new Action<PageContext>(this.ParseMapEdit_Context)
                    // This"validate" was in the documentation, but not sure why it's needed
                    // need to research this before enabling it.
                    // Validate = new Action<PageContext, IUrlAccessController>(Validate)
                };
            }
        }

      

        private void ParseMapEdit_Context(PageContext pageContext)
        {
            var allContext = pageContext.ContextItems.GetAllContextItems();
            var cnt = allContext.Count;
            int groupId = -1;
            for (int i = 0; i < cnt; i++)
            {
                var typename = allContext[i].TypeName;
                Guid appId = allContext[i].ApplicationId.Value;
                if (typename != "Group" || true)
                {


                    if (!int.TryParse(allContext[0].Id, out groupId)) { }
                    string singleMapApp = pageContext.GetTokenValue("mapAppSafeName") as string;
                    string singleMap = pageContext.GetTokenValue("mapId") as string;
                    Guid mapId;
                    if (!Guid.TryParse(singleMap, out mapId)) { throw new ArgumentException("...maps/{ID} is required."); }

                    if (groupId > -1)
                    {
                        var group = TEApi.Groups.Get(new GroupsGetOptions { Id = groupId });
                        ContextItem contextItem = new ContextItem();
                        if (!string.IsNullOrEmpty(singleMapApp))
                        {
                            PublicApi.Entities.MapApp mapapp = InternalApi.VerintDataService.GetMapAppByGroupId_Name(groupId, "mapapp", singleMapApp);
                            PublicApi.Entities.Map map = new PublicApi.Entities.Map(InternalApi.VerintDataService.GetVerintMap(mapId));

                            contextItem.ApplicationId = mapapp.ApplicationId;
                            contextItem.ApplicationTypeId = mapapp.ApplicationTypeId;
                            contextItem.ContainerId = mapapp.Container.ContainerId;
                            contextItem.ContainerTypeId = mapapp.Container.ContainerTypeId;    //Apis.Get<IGroups>().ContainerTypeId,  
                            contextItem.ContentId = map.ContentId;
                            //********need to look at the map entity, determine why MapTypeId is used for the ContentTypeId
                            contextItem.ContentTypeId = map.ContentTypeId;
                            contextItem.TypeName = ApplicationTypeName; //why would this not be Map 
                            contextItem.Id = map.Id.ToString();

                        }
                        pageContext.ContextItems.Put(contextItem);
                    }

                }
            }


        }
        #endregion

        #region SecuredContentType  
        private static readonly Guid _readMapsId = InternalApi.VerintDataService.ReadMapsId;
       
        Guid ISecuredContentType.DefaultPermissionId { get { return _readMapsId; } }

        Guid ISecuredContentType.DefaultContentPermissionId { get { return _contentTypeId; } }

        //public Guid DefaultContentPermissionId { get; private set; }
        //public Guid DefaultPermissionId { get; private set; }
        public Guid GetContentPermissionId(IContent content)
        {
             
            var securedContent  = content as ISecuredContentType;
            
            var contentPermissionId = securedContent.DefaultPermissionId  ;

            return contentPermissionId;
        }

        public Guid GetSecurableId(IContent content)
        {
            return content.Application.ApplicationId;
        }
 
        #endregion
    }


}

You may be right as to call me out on the correctness.. I think it's fully implemented however.
Here are the entities for Map and MapApp are here:

namespace CommunityMap.PublicApi.Entities
{
     
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

using Telligent.Evolution.Extensibility.Api.Entities.Version1;
using Telligent.Evolution.Extensibility.Api.Version1;
using Telligent.Evolution.Extensibility.Content.Version1;

using Telligent.Evolution.Extensibility;

using System.Runtime.CompilerServices;
using mapModels = CommunityMap.Core.Models;
using System.ComponentModel.DataAnnotations;
using CommunityMap.InternalApi;


    public class Map : ApiEntity, IContent
    {
        private InternalApi.Entities.VerintMap _map = new InternalApi.Entities.VerintMap();
         
        #region ApiEntity
        public Map() : base() { }
        public Map(AdditionalInfo additionalInfo) : base(additionalInfo) { }
        public Map(IList<Warning> warnings, IList<Error> errors) : base(warnings, errors) { }
        internal Map(InternalApi.Entities.VerintMap map) : base() { _map = map; }
        #endregion
        #region IContent
        internal InternalApi.Entities.VerintMapApp cmapapp { get { return InternalApi.VerintDataService.GetVerintMapAppApplication(_map.MapTypeId); } }
        public MapApp mapapp { get { return new MapApp(cmapapp); } }
        public IApplication Application { get { return MapApps.Get(_map.MapTypeId); } }
        public string Name { get { return _map.Title; } }
        public string Title { get { return _map.Title; } }
        public string Description { get { return _map.Description; } }
        public string AvatarUrl { get { return _map.ThumbnailUrl; } }
        public string ThumbnailUrl { get { return _map.ThumbnailUrl; } }
        public int Id { get { return _map.Id; } }
        public int ObjectId { get { return _map.Id; } }
        public Guid MapId { get { return _map.MapId; } }
        public Guid MapTypeId { get { return _map.MapTypeId; } }
        public string MapOptions { get { return _map.MapOptions; } }
        public Guid ContentId { get { return _map.MapId; } }
        public Guid ContentTypeId { get { return _map.MapTypeId; } }
        public int? CreatedByUserId { get { return _map.CreateByUserId.Value; } }
        public DateTime CreatedDate { get { return _map.CreateUtcDate.HasValue ? _map.CreateUtcDate.Value : DateTime.UtcNow; } }
        public int? ModifiedByUserId { get { return _map.ModifiedByUserId.Value; } }
        public DateTime ModifiedDate { get { return _map.ModifiedUtcDate.HasValue ? _map.ModifiedUtcDate.Value : DateTime.UtcNow; } }
        public bool IsEnabled { get { return true; } }
        public bool IsIndexed { get { return _map.IsIndexed; } }
        public int MapAppId { get { return mapapp.ObjectId; } }
        public string Url { get { return mapapp.Url +  _map.MapId.ToString(); } }

        public string HtmlDescription(string target) { return _map.Description; }

        public string HtmlName(string target) { return _map.Title; }
        #endregion
    }
}

namespace CommunityMap.PublicApi.Entities
{
    using System;
    using System.Collections.Generic;

    using System.Linq;
    using System.Text;
    using System.Threading.Tasks;

    using Telligent.Evolution.Extensibility.Api.Entities.Version1;
    using Telligent.Evolution.Extensibility.Api.Version1;
    using Telligent.Evolution.Extensibility.Content.Version1;

    using Telligent.Evolution.Extensibility;

    using System.Runtime.CompilerServices;
    using mapModels = CommunityMap.Core.Models;
    using System.ComponentModel.DataAnnotations;
    
    using TEApi = Telligent.Evolution.Extensibility.Api.Version1.PublicApi;

    public class MapApp : ApiEntity, IApplication
    {
        private CommunityMap.InternalApi.Entities.VerintMapApp _MapApp = new InternalApi.Entities.VerintMapApp();


        #region ApiEntity
        public MapApp() : base() { }
        public MapApp(AdditionalInfo additionalInfo) : base(additionalInfo) { }
        public MapApp(IList<Warning> warnings, IList<Error> errors) : base(warnings, errors) { }
        internal MapApp(InternalApi.Entities.VerintMapApp MapApp) : base() { _MapApp = MapApp; }

        #endregion

        #region IApplication
        public string Name { get { return _MapApp.Name; } }
        public string Description { get { return _MapApp.Description;  } }
        public Guid Id { get { return _MapApp.ApplicationId; } }
        public int ObjectId { get { return _MapApp.Id; } }
        public Guid ApplicationId { get { return _MapApp != null && _MapApp.ApplicationId != null ? _MapApp.ApplicationId : Guid.Empty; } }

        public Guid ApplicationTypeId { get { return _MapApp != null && _MapApp.ApplicationTypeId.HasValue ? _MapApp.ApplicationTypeId.Value : Guid.Empty; } }

        public string AvatarUrl { get { return _MapApp.AvatarUrl; } }
        public string SafeName { get { return _MapApp.SafeName; } }
        public IContainer Container
        {
            get
            {
                GroupsGetOptions groupOpt = new GroupsGetOptions();
                groupOpt.Id = _MapApp != null ? _MapApp.GroupId : -1;
                if (groupOpt.Id > 0)
                {
                    return Apis.Get<IGroups>().Get(groupOpt);
                }
                return Apis.Get<IGroups>().Root;
            }
        }
        public Group Group
        {
            get
            {
                if (object.ReferenceEquals(null, _MapApp)) { return null; }
                GroupsGetOptions groupOpt = new GroupsGetOptions();
                groupOpt.Id = _MapApp.GroupId;
                if (groupOpt.Id > 0)
                {
                    Group group = Apis.Get<IGroups>().Get(groupOpt);
                    return group;
                }
                Group groupRoot = Apis.Get<IGroups>().Root;
                return groupRoot;
            }
        }

        internal static MapApp Get(Guid applicationId)
        {

            InternalApi.Entities.VerintMapApp vma = InternalApi.VerintDataService.GetVerintMapAppApplication(applicationId);

            return new MapApp(vma);
        }

        internal static MapApp Get(string MapAppName)
        {

            throw new NotImplementedException();
        }

        internal static MapApp Get(int groupId, string MapAppName)
        {
            MapApp MapApp = new MapApp();
            MapApp = InternalApi.VerintDataService.GetMapAppByGroupId_Name(groupId, MapAppName, null);
            return MapApp;
        }

        public bool IsEnabled { get { return _MapApp.IsEnabled != null ? _MapApp.IsEnabled.Value : false; } }

        public string Url
        {
            get
            {
                string safeUrl = this.Group.Url + "mapapps/" + _MapApp.SafeName + "/maps/"; 
                
                return safeUrl;
            }
        }

        public string HtmlDescription(string target) { return _MapApp.HtmlDescription(target.ToLower()); }

        public string HtmlName(string target) { return _MapApp.HtmlName(target.ToLower()); }
        #endregion
    }



}

So I guess I am no longer sure where the confusion is.   You IContent.Get would get one of your Map objects by contentId.  Then you need IContent ISecuredContentType.Get(contentId)   it HAS to be defined  like this(explicit) so the platform only uses this version of Get in the subsystem for security.

IContent.Get could potentially have security implemented(thats up to you), the Secured version cannot check at all.  If neither of these do then they can be the same but I don't really recommend it.

Adding the IContent ISecuredContentType.Get.. please note the change to the code to pull the actual content or map, instead of just the new content..

 
   public IContent Get(Guid contentId) {
            IContent map = PublicApi.Maps.Get(contentId);
            //PublicApi.Entities.Map map = new PublicApi.Entities.Map();
            return map;
        }
         IContent ISecuredContentType.Get(Guid contentId) {
            IContent map = PublicApi.Maps.Get(contentId);
            //PublicApi.Entities.Map map = new PublicApi.Entities.Map();
            return map;
        }

I don't see anything wrong...though I can only assume your calls work 

I build it and checking it runs now..
this below code  doesn't look right to me...

   public Guid GetContentPermissionId(IContent content)
        {
            
            var securedContent  = content as ISecuredContentType;
            
            var contentPermissionId = securedContent.DefaultPermissionId  ;

            return contentPermissionId;
        }

        public Guid GetSecurableId(IContent content)
        {
            return content.Application.ApplicationId;
        }

I build it and checking it runs now..
this below code  doesn't look right to me...

   public Guid GetContentPermissionId(IContent content)
        {
            
            var securedContent  = content as ISecuredContentType;
            
            var contentPermissionId = securedContent.DefaultPermissionId  ;

            return contentPermissionId;
        }

        public Guid GetSecurableId(IContent content)
        {
            return content.Application.ApplicationId;
        }

GetContentPermissionId is just the ContentTypeId as I mentioned earlier

So the Group application permissions are working. At the group level permissions set here apply to all Map Apps...
The permissions on the application are not working... still have errors when using these, so I can't actually access these settings yet.  

is the way to get the application permissions using  NodePermissions.Get and Permissions.Get ?

and if so, then how do I use what we setup to get the permission settings? for the nodePermission, the  application string is not found.. and then for the Permissions.Get the entity type is not secure... so not sure what to do next.

You really can't use NodePermissions here, you should be using the IPermissions api.   Have you tried going back to that since you have fixed everything else?

Reason for the node permission not being a great solution is it actually pre-dates permission extensibility so it is going to be very tied to core applications.

no I have not. I will work on that... hope I can figure it out this sprint... one more week.  ipermission api.. 

so this is the permission check that I tried, and it still has the "the entity type is not secure" error. 
PermissionCheck check2 = TEApi.Permissions.Get(group_permissionId, userId, applicationId, mapApp.ApplicationTypeId, _entityPermissionType);

is there anything I can do to fix this? override this? if so, what would that look like?

Ok digging deeper this is going to be another scenario where this method really does not support the extended permission model  and another reason why upgrading is going to be important.

You can try using the content Id, so this would be an item in your application not the application and see if that will work(it should based on what I see).  If not it seems you are running into limitations that are alleviated in later product versions.

yes, I believe at version 9.x, adding our own applications was considered a new capability, and many things were to be improved in 10.x 
Actually, developed my first iteration of this project on version 10.. but we didn't upgrade to allow us to migrate to Amazon, so had to build the project in 9.x. 

I will try using content id's and post results on this thread.

For the most part, at least I have the permissions laid out nicely and the defaults are shown for each role for both group and application.

I will include the group level permission settings for the content, that way, I can at least have group level permissions checks. Then when we can, add the application level permission checks when available, and also try using the content Id.

if you think of anything, I'll be happy to work thru this too.

Thank you so much for your help.