There are two basic permissions per user:
- Transferring objects (via dragging them or as equipped tooltips and item shelves)
- Saving own copy of the world
And additionally each user can be configured with allowed locomotion modes (this sits on the CommonTool component).
All of these are configured by the CommonAvatarBuilder component, which usually sits on the User Spawner slot in the Root of the world.
Open inspector for this component to configure these settings. To restrict locomotion modes, disable "AllowAnyLocomotionForXYZ" (where XYZ is Owner/Host/Guest) and then add new items to the "AllowedLocomotionModes" list.
If the list is empty, no locomotion will be available.
The settings take effect for newly joined users. To make them affect you, you need to close the experience and load it again, so your avatar gets respawned.