Third, I detest permissions! When a usergroup permission is designated "Inherit" and I have no idea where it came from or how to alter it, I always struggle. To be safe, I always go through EVERYTHING again.
Permissions are the strongest point of XenForo and at the same time one of its weakest.
And that's partially due to what you relate. That ties directly into the way you also use/assign your groups. People that come from a script like IPS/Invision or any other that uses a static group for all permissions and have to set multiple primary groups for each need have great difficulty adapting.
Once you do learn the permission set, you begin to realize how forward thinking the XenForo developers were as you don't have to keep repeating permissions in multiple groups and just change one then assign a user or users to that one group to do something like limit their using of reactions (if using the appropriate add-on) or limit their use of an add-on to make entries until a promotion is ran.
The biggest problem I've seen in my decade of use of the script is users trying to shoe-horn the way XenForo uses groups/permissions into what they were used to with their old script.
Classic case is creating a new group with all the permissions that you want and then changing the default user group for users from
Registered
to whatever new group you configured. When you start doing that, you break the design. It can be used that way, but it becomes MUCH more complicated and you pretty much add to the complexity and issues you have running automated promotions.
As for how to find where it comes from... the ACP has the ability to analyze the permissions for a user and it will tell you that.
One thing that many forget about.. if you add a new add-on to the site that uses a few permissions, you need to make sure that you check your groups to modify their permission sets for that new add-on. Frequently folks will forget to set the for their moderator and administrator groups, only concentrating on the registered and any other member level permissions.
Personally, I can't think of anything I hate about XenForo forum software.
Biggest one for me is their long-term dependence on outside developers to offer features (or extend their base offerings) to what other scripts have native. And unluckily, many of those 3rd party extensions add to the cost of the base script.