If a group of users in SharePoint are supposed to be able to create sub-sites and see certain content, and another group of users can't create sub-sites and is meant to see different content, set up test users in the appropriate groups and test the permission levels (particularly right after a deployment).
Also, ensure that permissions testing is completed if a Publishing workflow is enabled. Add a set of test users to each of the specific SharePoint Groups (i.e. Contributors, Approvers, etc.) and log in as those users to make sure the workflow is properly set up and aligned with the business needs.