The ability for players to learn and cast spells can be fully configured using the available permission nodes, listed below. You can use any permissions management plugin that supports Bukkit's built-in system.
I recommend bPermissions, since it seems to be the best-implemented permission plugin of the ones currently available. (I've also started a permissions plugin of my own, called YAPP. It is intended to be really powerful, yet fairly simple to use.)
By default, normal users do not know any spells when they first log in, but they can learn to cast any spell. Server operators will already know all spells, and will be able to teach spells to other players. If you would like to change this on your server, you can use these permission nodes.
Important: Please note that when it says “spellname” you should fill in the internal name of the spell (the section header name in the config file). Don't use the redefined name you provide with the “name” configuration option, don't use anything from the spell-class option, and don't just leave “spellname” there, obviously.
Important: Many of the permissions in this plugin default to true (for ease of setting up the plugin for people who have never used it before). If you wish to completely control the permissions, you can make all permissions default to false by setting the default-all-perms-false option to true in the General Configuration.
A player with the magicspells.learn.spellname node will be able to learn the specified spell (from teach spell, a spellbook, a tome, etc). If they don't have this permission, they will not be able to learn the spell. This permission does not give them the spell, it just allows them to learn it. This defaults to true for all players. The magicspells.learn.* node will give permission to learn all spells.
You can automatically grant spells to a user (so they don't have to learn them) by giving them the magicspells.grant.spellname permission. A player with this permission will be taught the spell permanently the moment they log in. If a player gains this permission node while logged in it will not automagically give them the spell. Removing this permission node will not unlearn the spell. This will override the learn permission (this will give them the spell even if they don't have the learn permission for that spell). This defaults to false for all players. The magicspells.grant.* node will grant all spells.
A player must have the magicspells.cast.spellname permission in order to cast a spell. This permission does not give them the spell, it just allows them to cast it (if they already have it). For many servers, modifying this permission node will not be necessary. It can be used if you want to deny access to certain spells on certain worlds. This defaults to true for all players. The magicspells.cast.* node will give permission to cast all spells.
The magicspells.teach.spellname permission is required if a player needs to teach a spell to another player. This also affects creating spellbooks and (optionally) scrolls. Keep in mind that even if a player has this permission, they will not be able to teach spells unless they have learned the teach spell themselves. This defaults to true for all players. The magicspells.teach.* node will give permission to teach all spells.
/cast list <player>)/cast forget <player>)/cast scroll -base <spell> [uses])