I was wondering the same thing. So, for a developer, you can call Player.hasPermission(string) to test if the permission is present. As for where those permissions come from, I don't know. I remember someone saying something about a default Bukkit plugin because the bukkit permissions are just a framework and not an actual permissions system. But that's all I know.
