Installed using python-3.6.1-amd64.exe then tried to pip install a package. Repeatedly had to manually intervene to open up permissions on python install subdirs, after getting these errors one at a time from pip:
PermissionError: [WinError 5] Access is denied: 'c:\\program files\\python 3.6\\Lib\\site-packages\\fontTools'
PermissionError: [Errno 13] Permission denied: 'c:\\program files\\python 3.6\\Scripts\\pylupdate5.exe'
PermissionError: [WinError 5] Access is denied: 'c:\\program files\\python 3.6\\share'
Gave up and set "full control" on \python 3.6\ dir and contents.

It seems permissions default to "read-only" subdirs which makes pip installs impossible. Install and pip used under same userid and same session. I thought I'd clicked yes to any question "install for all users".

You installed Python for all users, which defaults to installing in %ProgramFiles% or %ProgramFiles(x86)%. Python's installation directory inherits the security of its parent directory, which in this case grants full control only to SYSTEM, TrustedInstaller, and Administrators. Standard users are granted only read and execute access. Thus if you're logged on as a standard user or UAC-restricted administrator, adding and removing packages requires running pip from an elevated command prompt (cmd.exe) that's "[r]un as administrator".

A per-user installation, on the other hand, defaults to installing in a subdirectory of the user's "%LocalAppData%\Programs" directory, for which the user should have full control.

In either case you can change the default installation directory. In general, I wouldn't recommend installing for all users to an untrusted location, but you're of course free to do that if you want.

You can try installing with "--user" to install to a per-user directory, start running pip from an administrative command/PowerShell prompt, or use the venv module to create a virtual environment.

Alternatively, if you select the default installation options you will get one that you can modify freely, but because it's in your user directory nobody else on the machine can use it.

Installing to Program Files is supposed to be read only. You're welcome to open it up, just be aware that it is a security risk to do so.