The gnome-volume-manager will automatically mount removable devices as they are connected. It is run as part of the default Debian session, but will also be started, if needed, if you enter the Removable Drives and Media application under Desktop, Preferences menu. Otherwise it will need to be run in your session (add gnome-volume-manager to DesktopPreferencesSessions). The users need to be in group plugdev.
Note that this works best when you run a single X-session at a time (which is the common scenario). If you have two or more users with concurrent X-sessions on different tty's the permissions become an issue. In this situation it is perhaps best to use the Disk Mounter applets to do the mounting.
If you prefer to give gnome-volume-manager a try in the
situation with concurrent users with different X sessions on the one
console, and for trusted users (those in plugdev), you could
use the following /etc/fstab entry:
/dev/usbkey /media/usbkey auto users,gid=plugdev,umask=0002,defaults
The main points here are the use of users to allow any user to unmount the device, and when mounting the device the gid (group ID) is set to plugdev. The umask then allows group access but not others.
$ strings /usr/bin/gnome-volume-manager | grep pmount
Also pmount's policy is hard-coded and so also has limited configurability. Part of pmount's policy is that you need to be able to run pmount in order to mount a device, and so you need to be in the plugdev group to mount a device. An entry in /etc/fstab overrides pmount's policy.
In order to be able to umount a device, the device needs to have been mounted by the user. This is enforced by checking /etc/mtab and parsing the mount options looking for . needs to be the uid of the user trying to unmount the device. The policy is that if you can run pmount and fulfill certain criteria, you can mount a device. And pumount's policy is that if you are the user who mounted the device and fulfill certain criteria, you can unmount the device.