Users are able to create private projects and assign other users to projects. All related objects have permissions checks to ensure they belong to a project that a user has permission to access. Consider adding Organization level permissions & private projects instead of grouping by User (discuss).