Hi Ulrich,
I think I understand what you are describing, so my recommendation is, create collections in the root, set permissions on the collections, upload files into the collections, not the root. Uploads will then inherit permissions of the collection they are in. If you need to modify permissions on a collection, you must then check the box ("reset permissions on all subfolders" - it says something like that), then hit apply/update.
Rob Ralston