Projects
Security of projects is dictated by the project type. If an individual has view access to a project type, then they can view projects of that type.
Consider this example. You have Project A of type General Projects. General Projects can be viewed by all staff. You have a sub-project setup of this project as Project B, and it is of type "Pastoral Visit". Pastoral Visit projects can only be viewed by pastors. If Ted is both a staff member and a pastor, he can view both projects. If Cindy is a staff member but not a pastor then she can only view "Project A".
Tasks
Tasks inherit their security from the project they are a part of.
Sometimes you want to give somebody the ability to leave comments and add to the discussion but not give them access to edit a project. There is a security permission on Projects and Project Types of Comment. This will allow somebody to leave a comment on a project but not edit it. A person with Edit access can both edit and leave comments.