We've had a few accidents recently such that developers accidentally
removed components or streams, and also some can't add new component
to a stream/team area. So we are trying to find proper permission
settings to prevent this from happening again.

Our SCM environment is like below:

1. We use shadow project area to control access to the components. The
shadow project area owns the components and only people on the Access
list in the shadow project area can access the component;
2. In the shadow project area, the Permission is set at Team area
level to allow Everyone (which is the only role defined there) to
Add a component to a team/project area but not Delete one;
3. In the primary project area corresponding to the shadow ones:
at project area level, no permitted actions for SCM is defined
for any role
at team area level, for contributor/teamlead roles, allow all
actions around component except Add a component to a team/project
area or Remove a component to a team/project area;

at team area level, for contributor/teamlead roles, allow all
actions around stream including Add a component to a stream, Remove
a component to a stream, Replace a component to a stream

We want to have tighter control on who can add/remove components.

When one creates/adds a new component in one's own workspace, is it
considered as added to team/project area one is in too?

We have developers created/added new components in their own workspace
without issue, but got permission error when deliver the changesets
for the component creation to the stream.

I first enabled Add a
component to a team/project area at team area level for all roles in
the primary project area as it is already enabled in the shadow
project area, and still the same permission error.

Then I found that
the stream involved was actually owned by the primary project area
which the developer is not a member. After changing the stream's
ownership to a team where the developer is a member, the deliver went
through.

So it looks like that as we use shadow project area to own SCM
component and allow allow Everyone (which is the only role defined
there) to Add a component to a team/project area but not Delete
one; the relevant permission setting on the primary project area is
obsoleted.

Now I have teams want to limit the ability to add/create component to
only a few people in the team. I guess I have to do it on the shadow
project area by creating a new role and grant it the permission to
Add a component to a team/project area but not Delete one; and stop
allowing Everyone to Add a component to a team/project area.

If this is the right way to do it, I guess most developers will not
be able to create/add new component to team/project area. I am not
sure when it is going to happen: right from the time when they
create/add new component in their workspace or when they try to
deliver the relevant changeset to the stream?

Geoff,
Thanks for your time.

If I understand correctly what you said, here are what is happening in
our current environment when one create a new component in a
workspace and then deliver to a stream:
1. When one creates a new component in a workspace, what is created is
just personal component, owned by the user that created it;
2. If one then tries to deliver it to the stream the workspace has
branched off from, then the component is added to the stream, and the
owner of the component is assigned to the shdow proejct/team area as
we allow all valid user to be able to add new component to the shdow
proejct/team area ;

Now we want to stop allowing all to be able to add new component to
the shdow proejct/team area and limit that ability to a few with a
new role.

But what happens to a user who has not been assigned the new role on
the shadow project/team area when a delive involving new component
creation is done:
will the deliver fail because no permisssion to add new component to
the shdow proejct/team area?
or it will go through but the ownership is still owned by the user
that created it;
and we'll need to do a ownership change then?