I know that permissions are done in Windows through Properties (the equivalent of Macintosh 'Get Info'), so I used that. It offers a Securites tab and that shows a bunch of user type things and their permissions. None of them are say IIS_IUSRS.
I clicked Edit. Then I clicked Add. Seems easy but, what do I do then? Eventually, I pasted the value into the 'Enter Object Names' (a permission object?) and clicked a button called Check Name. It revised the string to include the server name. Eureka! It recognized it and did something sensible. Save save save. Try the website. Nope. But, it was Nope with a different error message. That spells progress.
The error message was now a 403.1 talking about access control, etc. I googled it ("windows 7" directory or page because of the access control list (ACL) configuration or encryption settings) and found a page that instructed me on how to set the IIS user. It basically comes down to finding that Authentication icon in the IIS7 manager, finding the site (sandbox) and checking out its Properties (right-click Properties is used for everything!). That page suggested I change the user to match my permissions but, seeing the user that was automatically set, IUSR, I thought, I'd add that to the permissions for Visual Studio's directory.
And that, my friends, did the job.