For the most part, permissions are granted manually: a user with administrative privileges adds a user, group, or unit and a corresponding permissions profile to a project's Team section. There are a couple places in the system where as a convenience, users are automatically added to the project's Team section along with a set of permissions on a project: after allocating a user to a project (on project Staffing) and after scheduling a user to a task (on project Tasks). You specify the profile to use (the "default" profile) on Admin/Organization/Resource Settings:
Using the screenshot above as an example, any user who was allocated to a project or scheduled to a task would be added to the project team with the "Project Member" profile, as specified above.
Note that if the user already has permissions on that project directly (not from group or unit membership), the default profile will not be applied.
If the staffing allocation or task schedule is deleted, the user will still have permissions on the project (will still appear on the Team section).