User Management

How do I change user permissions? I recently started adding contributors to my blog, and they’re having trouble posting certain content. I want them to be able to post whatever I can, but not publish it. I originally had them set as “Contributors” but they couldn’t upload images, so I upped them to “Authors”. Now they can publish, which I’m not crazy about. But they’re also unable to embed YouTube videos or any <object> tags, as soon as they publish their posts, the code disappears. It’s weird. Is this also a permissions thing?