Mike Boe Dustin Smith - we have achieved these scenarios and you can achieve this security at the category, article levels to restrict users through Block Inheritance feature and for readers, we suggest you to leverage the reader groups and map them to those groups, then restrict the group at the category / article level. Please refer the below documentation for details.

Mike Boe we have been able to do a similar sort of thing (draft only at project level with publish rights limited to certain categories) via overlapping security groups. If you assign the user a Role with extremely limited permissions, you can then add them to two security groups: 1) where they have read-only permissions at the project scope and 2) where they have edit/publish permission with the scope restricted to specific categories.