access authorization

Hi,
i'm sharing a projecet with my friend and giving him write access but then he can't pull untill i give him admin access. I think even read access can pull sources.. is this a bug or we are doing something wrong?