Security through Obscurity
I'm seeing as I work with SmugMug that I need to take a different approach on the security of my photos. In Phanfare, I'd move albums to subsites and could control album visibility by subsite.
In SmugMug, I've found I'm having to do the following security settings to share photos with people:
Visibility: Unlisted (Anyone with the Link)
Access: Anyone with a Link
The original photos need to have the permission set. They aren't easy to find because someone has to guess some random gibberish in the URL to access them.
I'm putting my photos in a "Main" folder organized by years. Then I'm creating some other top-level folders (my concept of how to do a Phanfare subsite) and collecting the pictures I want to share in galleries in those folders. It took me a few exchanges with SmugMug support to figure out how to even see the pictures I'd collected elsewhere. That's because the security comes from the "master" photo--if it's private, you won't see it elsewhere.
This brings up a potentially frustrating problem with how the Phanfare -> SmugMug migration collected photos. As it turns out, my migrated galleries might have a collection of collected photos and original photos. I have to find the originals of every photo to change the permissions. I'm not sure how much of a mess it's going to be for me yet, but I did have several subsites, so it's possible my original photos are scattered all over the place. I still need to work more with this, but I'm starting to make some sense of the new security model.