How does the FAQ security work?

First of all there are two access rights involved. If you have faq.edit rights you may create and potentially change FAQ questions. If you have faq.admin rights you may create and potentially change and delete FAQ questions and FAQ categories.
In order to create a FAQ question/category you only need the appropiate access right. In order to change or delete a FAQ question/category you need the appropiate access right and you also need write access to the specific FAQ question/category.
FAQ questions also inherit rights from the FAQ category they belong to. This means you may not create, change or delete a FAQ question in a FAQ category you do not have write access to. A user that may not change the FAQ categories, but should be able to change FAQ questions should hence have the faq.edit right (but not the faq.admin right) and write access to both the appropiate FAQ categories and FAQ questions.

See also: Why do my users not see the FAQ link/categories I have created?