Spec for default permission encoding?

[Dain Sundstrom]

Is there a spec somewhere that explains how the default encoded  
permission string maps to the construction of a permission object?  I  
tried to follow the code but got lost trying to follow how the string  
is split-up between permission construction and the  
WildcardPermission.  I'm also interested in how you escape special  
characters like comma and colon.

Also, is there a spec for WildcardPermission.implied().
-dain