There are some permission controls, but not a lot. At then end of they this is a tool to help with collaboration, but I do understand the desire to keep some things locked down. There are some options available.
Here is a quick summary.
- You can set a Team as Hidden, Membership By Request, Public to Organization.
- Use Hidden if you don’t want people outside of the Team to see it.
- Use Membership By Request if you want people to know about the Team, but only join if specifically invited or their request to join is granted.
- Make Public if you want anyone to be able to see and join the Team.
- You can set a Project as Private to Project members or Public to the Team.
- Use Private to Project members, if you only want Project members to be able to see the Project.
- Use Public to the Team, if you want everyone in the Team to be able to see the Project and join it.
- You can set members of a Project to Can Comment or Can Edit
- Use Can Comment to allow them to post comments, and other minor changes to Tasks, but they won’t be able to change Project membership as well as a number of other changes.
- Use Can Edit if you want them to be able to make any Project or Task changes they want.
You can also poke small holes in these rules. For example you add someone as a follower of Task that isn’t a member of a Private Project or a member of a Hidden Team, without that user having access to anything but the Task.
There is more info in these Asana help pages.