Several comma-separated tags will be considered as logical AND between them. You can also use semicolon for logical OR. AND has a priority over OR and you cannot use parentheses for logical grouping. Asterisk (*) within a tag will be regarded as a mask for "any string".
Since Cotonti 0.0.2 you can (and should) set what user groups are allowed to download files associated with Pages.
In order to do that you should go to Administration => Users or Administration => Pages => Structure of pages (categories) and choose a Group or Category which you want to set permissions on. Click the permissions icon there.
After you have located permissions page, you need to switch to Advanced mode by clicking the More link a the bottom: