I'm not live yet -- still working on shifting from the old system.  I've been reading a lot of the forum, and it seems to me that a lot could be done by linking membership in groups with other user rights automatically.  Making a user a member of the group automatically gives him certain rights.

I, for example, would like all my unvalidated users to have pretty much the same rights as a guest -- look at low res public pictures and not leave comments, download, or upload.  But "guest" is a user type, not a group.  And while I can make a certain group the default user type, I cannot make a user type the default.

Then, once they are validated, I want to change their user type to user and give them high-res (and thus download) rights.  But they need their comments validated.

I want another trusted group to be able to leave comments without validation and upload with validation.

Maybe someday I'll even want a group that can upload without validation.

Right now, there are different places that these need to be done.

Now, since I want to make an unvalidated user essentially a guest, I can use UserAdvManager and lock them out until validated and let them still view as a guest.  But if I wanted a different set of rights for a guest and unvalidated user, then that would not work.