For example, I want to allow board members to create cards and comment on cards, but not move cards between lists or alter lists.
Trello is very much like a wallboard with Post-it note cards with lists.
Anyone with physical (edit) access to the board can make changes.
Currently, the best approach is to discuss the issues with your team members and set guidelines for everyone.
You may not be able to enforce the guidelines, but card activity tracks who made what changes so you can tell who changed what.
Visit the development boards by Trello to suggest changes. Vote on cards for features you would like to see.
I think you could accomplish something similar to this by doing the following:
- Use your board's email-in feature (settings -> Mail Settings) to let users mail in new cards. You can even use IFTTT to do things like "If text message tagged #idea, Then send gmail to firstname.lastname@example.org". Alternately, you could create a web form that emails to this address. This effectively lets anybody you give the address to create cards.
- Set your board's "comment" permissions to Organization
- Set the members to "observers" (this requires business subscription: http://blog.trello.com/introducing-business-class/) OR, if it's public, then you can allow public comments in the same place (no business subscription required)
That said, I agree with Kevan: simpler is better. Ask yourself (or whoever these requirements are coming from) "What bad things happen if somebody modifies the board in a way we don't like? What would we do to them if they modified a paper post-it-note board?" For example, if an employee routinely vandalized an office whiteboard, they may be marched out the door ;) Obviously, this may not be your situation, but it may help think through the security requirements...