Security Roles are one of the trickiest parts of the configurating Microsoft CRM.  We've run into several situations where a very non-intuitive security role setting was resulting in users saying "I cannot reassign an activity to another user" (or a case).  Fixing the problem takes 15 seconds if you know where to look - or hours of frustration if you don't.