Setting access rights in Tridion is quite a challenge. In our case we connect with SSO and rights are set based on our profile. The team is always administrator with all the rights. This means we always need to ask a user with certain rights to help out when things don't work the way you expect.
We also work with a Digital Assets Management product that also uses SSO to connect. When setting rights however, in that product we are able to impersonate a user to check the rights. This way we can check ourselves if the rights are working the way we expect things.