We have what we initially thought was a bug, but after some ILSpy'ing I determined it was intended behaviour:
Basically, user access is currently a manual process for project sites/workspaces on top of the resources added to the project site automatically based on their categorization/task assignments, etc.
However, whenever a workspace sync kicks off it will first REMOVE the SharePoint user from the site and then subsequently re-add them with the project server permission level that applies to them. This becomes an issue when this user has already been manually added to the project workspace site with an even greater permission level.
We're currently on SP1 - has this been corrected in a later CU? Should we look at workspace permission management as an all or nothing approach? (either all manual, disable all workspace syncs or little to no manual and let PWA handle all access)
