Permissions change when you don't do anything!
You give permission explicitly to a user, but they can't log in.
Or.... They can log into one site but not the other and you set them up
identically (using the same userid for login to both).
I don't get it but it has happened too often and from what I have heard to
too many people to be simply a fluke. It may be that it is affected by
variables that are not defined well by MS up front.