I've written about XBAPs and full trust in the past, but never as thoroughly as Karen Corby just did in her post on XBAP trust levels.  She spent a lot of time getting this post correct, reviewing with various folks within Microsoft and providing very solid guidance.  It is the kind of post that should be in the SDK and official docs, but didn't make it due to time constraints.  If you have questions about XBAPs and full trust, this is a must read.  Her deployment recommendations in particular are essential if you are thinking about going down the full trust XBAP road.  But keep her guidance in mind: only do this if you must.  ClickOnce .exe's are pretty slick and don't have nearly the issues associated with them as full trust .xbaps.