enhanced access control

I am wondering if we could increase the level of control of access to the different features. For example, I would like customers to be able to add events once they post events, but I would prefer not to give them the rest of the access that a manager has to assign and close the task. Also, it would be great if a reader had access to some of the other fields within the trouble ticket. Finally, even though I assign a scope with upload privileges, they don't seem to hold unless I also give manager access.

Perhaps this is already possible and I'm missing it. I'm still a bit confused about access control. It seems like it might be better control at the Drupal level.