When you add a new user and set that user's rights for a particular project, you create an assignment in the VSS database. That assignment propagates down the project list until another assignment is reached.
For example, you assign Add rights (RCA) to user Maria in $/, the root project. In the $/Samples project you give her no explicit assignment, so she automatically has the same rights (RCA) as in the parent project, $/. However, in $/Samples/BusinessObject, you set up a new assignment giving her read-only (R) rights.
This action blocks the earlier assignment in $/Samples from propagating down the tree, so that she has read-only rights in $/Samples/BusinessObjects and any projects under it.
In project $/NorWind, you give Maria no specific assignment, so her rights from the root project, $/, propagate down the project list to $/NorWind. Therefore, she has RCA rights in $/NorWind and in its subproject.
Access rights always propagate down in this manner, so a user's rights in the root project ($/) form a set of default rights for that user. These default rights apply to all projects in which you do not explicitly set assignments.
When you first add a user, that user is given rights in the root project based on the default rights that you've established on the Project Security tab. You can, if appropriate, change the user's rights to globally modify the user’s permission level.