[exim] ClamAV scan permissions?

I'm having a problem with ClamAV. I'm running the new test snapshot of
Exim - but I don't know if that is the problem. ClamAV is running as
user ClamAV and Exim is running as Mail.

I was running Exim as Roor - but I am tyring to change that. So I'm
fixing access denied errors. This started when I was making the change.

I have ClamAV in the Mail group so it it should have rights to the scan
directory itself - and it does. But - it seems that it does not have
access to the directories that Exim creates within the scan directory.

So - how do I know or control the access rights of files passed between
Exim and ClamAV? What am I doing wrong?