The Monitoring Server component of PerformancePoint 2007 is responsible for managing the user rights as far as being able to publish dashboards, edit existing dashboards, etc. This article got me most of the way there in understanding how to set up user permissions, but I think it's helpful to point out a few other items.
Dashboard Designer is the interface for Monitoring Server user security.
This was not immediately clear to me. There are two basic aspects to the permissions: global permissions (such as administrator rights, being able to publish new dashboards, etc.) and per-Dashboard permissions.
To configure server (global) role assignments:
In Dashboard Designer, hit the Office button and then the Options button on the resulting menu:
On the resulting Server tab, hit the Connect button:
Once it logs in, hit Permissions:
On the resulting Permissions dialog, you can add users in DOMAIN\name form, specifying their server (global) role:
To configure permissions for individual dashboards:
Open the desired dashboard On its Properties tab, there is a Permissions section at the bottom:
Add your users (DOMAIN\name format again) and specify Reader or Editor roles. After changing these permissions, you must publish the dashboard.