I just wrote up the permissions user guide at http://docs.xp-dev.com/user-guide/permissions.html

Do tell if you’re having trouble with that.

I used to give users access to projects (either to view status or manage project tracking), but then only a subset of those users had access to the repositories (ie, I only want code developers to have access to the repositories). It doesn’t look like I can achieve this behavior with the new parent-child project-repository relationship (unless I created multiple projects). It would be nice if the permissions on the repository were separate from the project (ie, for a particular user to have write permission for a project but read permission on the repository).

If a user only has read permissions to a project, I assume that he wouldn’t be able to modify the iterations, stories, etc. and the wiki. Would he still have access to the forums? Perhaps there could be a little more clarification in the permissions user guide as to exactly what write permissions give access to in a project.

What you’ve described is actually quite useful for QA/Project management staff, where they may want to see the code, but will definitely want to edit/create bugs, tasks, etc.

Will add a story for it and try to get it done asap.