For years I was changing the primary usergroup instead of treating upgrades as a secondary usergroup. That was okay at first but I would run into problems here and there, most of them related to User Upgrades. After reading your Implementing Permissions thread I had to re-do all the permissions on my site. One thing I had difficulty last month was Node Permissions. If a usergroup has a permission value set to "Allow" in their usergroup setting then when you're in Node Permissions, you shouldn't have to change that permission to "Allow" since all you need is "Inherit". Well I noticed that if you make a subforum private, you have to set some of those permissions as "Allow" to work. Actually, I think this only happens with developer's addons permissions. So it might not actually be Xenforo's problem, but addon creator's problem.