We would like the ability for resources to add risks and issues to the projects they are assigned to, however, only the PM should be able to create/edit Change Requests.
This could be accomplished through a combintation of things:
Break up the rights so that Risks and Issues are together and Change Requests are separated
Project-Risk, Issue - Create/Edit
Project - Change Request - Create/Edit
Additionally, the rights could be granted to the PM - similar to whether or not they want to use the resource pool function or not - whether or not they want team members to be able to create/edir risks and issues.