As an FYI... the Manage Security wizard is a quick and easy way to determine where permissions are coming from when users are getting too much or too few access.
Select Manage Security from the Actions menu of any object where the access doesn't appear to be correct.
Add the user in question to the table by clicking the + button
Click on the Info icon for that user
The page that comes up will provide a list of all the permissions specified for the user along with where they come from (policy, ad hoc, lifecycle, etc.)
