Panel setting tabs show up for ALL users when adding/editing/creating content.

I have the same problem. Though my user does not have any panels related permission, the two tabs "Panel layout settings" and "Panel content" are shown and can be accessed by this user when viewing or editing content.

I think the reason for this unwanted behaviour lies in the definition of the menu items in panels_node.module:

  // Avoid some repetition on these:
  $base = array(
    'access callback' => 'node_access',
    'access arguments' => array('update', 1),
    'page arguments' => array(1),
    'type' => MENU_LOCAL_TASK,
  );
  // FIXME Statically setting the path in this way makes these tabs render on
  // ALL node - appropriate or not
  $items['node/%node/panel_layout'] = array(
    'path' => $base . 'layout',
    'title' => 'Panel layout',
    'page callback' => 'panels_node_edit_layout',
    'weight' => 2,
  ) + $base;

  $items['node/%node/panel_settings'] = array(
    'title' => 'Panel layout settings',
    'page callback' => 'panels_node_edit_layout_settings',
    'weight' => 2,
  ) + $base;

  $items['node/%node/panel_layout'] = array(
    'title' => 'Panel content',
    'page callback' => 'panels_node_edit_content',
    'weight' => 3,
  ) + $base;

Here the access callback is node_access with access argument update. Therefore any user which has permission for updating content gets those panel tabs displayed when vieweing or editing a node.

I also noticed 2 errors in the menu item definitions above:

• The 'path' array key of the menu item does not exist in hook_menu of Drupal 6 API anymore
• The 1st and the 3rd menu item have the same key: $items['node/%node/panel_layout']. I think the 3rd menu item should be something like$items['node/%node/panel_content']

I made following modifications to those items to fix the 2 errors and to display the 2 tabs "Panel layout settings" and "Panel content" only for users which have access permissions 'create panel-nodes' granted (Though I don't know which permission is really intended for these 3 menu items):

  // Avoid some repetition on these:
  $base = array(
    // 'access callback' => 'node_access',
    'access callback' => 'user_access',
    // 'access arguments' => array('update', 1),
    'page arguments' => array(1),
    'type' => MENU_LOCAL_TASK,
  );
  // FIXME Statically setting the path in this way makes these tabs render on
  // ALL node - appropriate or not
  $items['node/%node/panel_layout'] = array(
    // 'path' => $base . 'layout',
    'title' => 'Panel layout',
    'page callback' => 'panels_node_edit_layout',
    'access arguments' => array('create panel-nodes'),
    'weight' => 2,
  ) + $base;
  $items['node/%node/panel_settings'] = array(
    'title' => 'Panel layout settings',
    'page callback' => 'panels_node_edit_layout_settings',
    'access arguments' => array('create panel-nodes'),
    'weight' => 2,
  ) + $base;

  // $items['node/%node/panel_layout'] = array(
  $items['node/%node/panel_content'] = array(
    'title' => 'Panel content',
    'page callback' => 'panels_node_edit_content',
    'access arguments' => array('create panel-nodes'),
    'weight' => 3,
  ) + $base;

@brahms: Yes, that's where the problem is. Hence the giant FIXME notice. Adding access restrictions solves this problem indirectly, but doesn't really deal with the underlying issue. And that underlying issue has already been laid out in (at least five) other issues, so I'm marking this duplicate.

Also I've fixed this in -dev already =)