So there's lots of articles about pros/cons of different configuration options, e.g. http://msdn.microsoft.com/en-us/library/ee855123(v=office.12).aspx
We are using a combination of property bags (generally on the RootWeb) and a couple lists. A problem arises when there are users who have permissions only to a subsite - they can't read the property bags, or the lists, so they get an access denied.
I see two solutions: give All Authenticated Users read permissions to the lists, which implicitly gives them limited access to the RootWeb, which is enough to read properties, or elevating permissions (i.e. load the site as system account) to read the properties. Which is preferable, assuming it's something that needs to happen a lot in the SharePoint site? I assume that if I go with the elevating permissons route that I am going to want to organize my code such that I don't need to elevate several different times in one request?
I've got another question on some of the specifics of adding all authenticated users here: Programatically adding All Authenticated Users