If in doubt, or if you have users reporting permission-related issues, you can always use the Permission helper tool (shown in the following screenshot) to check your configurations. All you have to do is enter the user's username, select an issue that is in the project, choose the type of permission, and click on Submit. The tool will go through your permission configurations and display a report that explains what is required for the selected permission so that you can work out why the user does or does not have the selected permission:

You will always be asked to select an issue when using the Permission helper tool, even if you want to check a project-level permission, such as administer projects. In this case, simply select an issue that belongs to the project, and the tool will verify the permission for you.