Project permissions
In Sitecore Content Hub, a user role assigned to a project controls user access. By default, there are three project roles. If a user is assigned a role, that same role is granted to all associated sub-projects but not to the project's parent or any other project above it in the hierarchy. The Break inheritance action removes the user's role for a specific project in the hierarchy, as well as all sub-projects below it but it does not affect inherited roles above that point in the hierarchy.
By default, users in the Project.Administrators group have Create, Read, Update, and Delete permissions on all projects, tasks, annotations, and comments plus assets. You can customize the security model to fulfill the required business logic.
Task-level permissions
Security is also applied at the task level, with all assets linked to the task inheriting their permissions from that task. For example, with a Download task, permission to download is applied to any content linked to that task.
When you assign a task to a user, they are temporarily granted permission associated content. For example, if a user is assigned the Edit Content task, they are granted temporary permission to edit any content associated with the task.