Repository: liqd/a4-meinberlin

Issue:
rules/participate in project
As you can see in the test, the paricipate_project rule behaves a bit weird for project group members. I think, they should also be allowed to participate. The question is what it is used for.

Cool! The participate_project rule is a bit unexpected, so we should check that out. Like where it is used and what for. But anyway, will merge for now and add an issue.

_Originally posted by @fuzzylogic2000 in https://github.com/liqd/a4-meinberlin/pull/4077#pullrequestreview-837466549_


Discussion:
@fuzzylogic2000 can you prioritize this? Don't know if it should go into the milestone.
@sabinammm  Haha, this is exactly the issue we just saw in the list. :)

@CarolingerSeilchenspringer This is actually for you to decide. There are a few things that project group members are not yet allowed to do, but that are allowed for initiators and sometimes also moderators. Like taking part in a private project, they are group member, but not participant in. 
@fuzzylogic2000 a thanks, I didn't know what it was about. Yes, let's talk about it in person. 
@fuzzylogic2000 is this still outstanding?
> @fuzzylogic2000 is this still outstanding?

Yes, but good point, I will assign myself, make a list and then @CarolingerSeilchenspringer has to decide
@CarolingerSeilchenspringer I stumbled over this again when I wanted to write tests for group members. So, the problem is:
Sometimes group members have the same rights as initiators, but in other cases they don't.
For example for add or change projects the group members have the same rights as the initiators and they should as this was what it is all about.
But for participating in a project, the group member is only allowed to do that in a public project, like the normal user. For draft or private projects, the group member is not allowed to participate while the initiator and even the moderator is allowed to participate. I don't find that logic and would like to change that.
@fuzzylogic2000 yes, please change that, I don't think that was intendet. Group members should be able to do the same thing as initiators only restricted to their project(s).

Resolving patch:
diff --git a/meinberlin/apps/projects/rules.py b/meinberlin/apps/projects/rules.py
--- a/meinberlin/apps/projects/rules.py
+++ b/meinberlin/apps/projects/rules.py
@@ -17,5 +17,6 @@
                 & is_live))
 
 rules.set_perm('a4projects.participate_in_project',
-               is_superuser | is_initiator | is_moderator |
+               is_superuser | is_initiator |
+               is_moderator | is_prj_group_member |
                ((is_public | is_project_member) & is_live))


Test patch:
diff --git a/meinberlin/test/helpers.py b/meinberlin/test/helpers.py
--- a/meinberlin/test/helpers.py
+++ b/meinberlin/test/helpers.py
@@ -6,22 +6,20 @@
 
 
 @factory.django.mute_signals(post_save)
-def setup_group_member(organisation, project, group_factory,
-                       user_factory):
-    group1 = group_factory()
-    group_member = user_factory.create(groups=(group1, ))
-    if organisation:
-        organisation.groups.add(group1)
-    else:
-        organisation = None
-    if project:
-        organisation = project.organisation
-        organisation.groups.add(group1)
-        project.group = group1
-        project.save()
-    else:
-        project = None
-    return group_member, organisation, project
+def setup_group_members(project, group_factory, user_factory):
+    group_org = group_factory()
+    project.organisation.groups.add(group_org)
+    group_member_in_org = user_factory.create(groups=(group_org, ))
+
+    group_pro = group_factory()
+    project.group = group_pro
+    project.save()
+    group_member_in_pro = user_factory.create(groups=(group_pro, ))
+
+    group_out = group_factory()
+    group_member_out = user_factory.create(groups=(group_out, ))
+
+    return project, group_member_in_org, group_member_in_pro, group_member_out
 
 
 def assert_dashboard_form_component_response(
diff --git a/tests/bplan/dashboard_components/test_views_bplan_basic.py b/tests/bplan/dashboard_components/test_views_bplan_basic.py
--- a/tests/bplan/dashboard_components/test_views_bplan_basic.py
+++ b/tests/bplan/dashboard_components/test_views_bplan_basic.py
@@ -6,7 +6,7 @@
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.apps.bplan.phases import StatementPhase
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('bplan')
 
@@ -62,10 +62,10 @@ def test_edit_view_group_member(
         user_factory):
     module = module_factory(project=bplan)
     phase = phase_factory(phase_content=StatementPhase(), module=module)
-    group_member, organisation, bplan = setup_group_member(
-        None, bplan, group_factory, user_factory)
+    bplan, _, group_member_in_pro, _ = setup_group_members(
+        bplan, group_factory, user_factory)
     url = component.get_base_url(bplan)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
     assert len(mail.outbox) == 1
diff --git a/tests/bplan/dashboard_components/test_views_bplan_plans.py b/tests/bplan/dashboard_components/test_views_bplan_plans.py
--- a/tests/bplan/dashboard_components/test_views_bplan_plans.py
+++ b/tests/bplan/dashboard_components/test_views_bplan_plans.py
@@ -4,7 +4,7 @@
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.apps.bplan.phases import StatementPhase
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('plans')
 
@@ -37,11 +37,12 @@ def test_edit_view_group_member(client, bplan, module_factory, phase_factory,
                                 plan_factory, group_factory, user_factory):
     module = module_factory(project=bplan)
     phase_factory(phase_content=StatementPhase(), module=module)
-    group_member, organisation, bplan = setup_group_member(
-        None, bplan, group_factory, user_factory)
+    bplan, _, group_member_in_pro, _ = \
+        setup_group_members(bplan, group_factory, user_factory)
+    organisation = bplan.organisation
     plan = plan_factory(organisation=organisation)
     url = component.get_base_url(bplan)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/bplan/rules/test_rules_add.py b/tests/bplan/rules/test_rules_add.py
--- a/tests/bplan/rules/test_rules_add.py
+++ b/tests/bplan/rules/test_rules_add.py
@@ -2,7 +2,7 @@
 import rules
 from django.contrib.auth.models import AnonymousUser
 
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_bplan.add_bplan'
 
@@ -14,14 +14,18 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_add(organisation, user_factory, group_factory):
+def test_add(project, user_factory, group_factory, admin):
     anonymous = AnonymousUser()
     user = user_factory()
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    organisation = project.organisation
     initiator = organisation.initiators.first()
-    group_member, organisation, _ = setup_group_member(
-        organisation, None, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, organisation)
     assert not rules.has_perm(perm_name, user, organisation)
     assert rules.has_perm(perm_name, initiator, organisation)
-    assert not rules.has_perm(perm_name, group_member, organisation)
+    assert not rules.has_perm(perm_name, group_member_in_pro, organisation)
+    assert not rules.has_perm(perm_name, group_member_in_org, organisation)
+    assert not rules.has_perm(perm_name, group_member_out, organisation)
+    assert not rules.has_perm(perm_name, admin, organisation)
diff --git a/tests/bplan/rules/test_rules_add_statement.py b/tests/bplan/rules/test_rules_add_statement.py
--- a/tests/bplan/rules/test_rules_add_statement.py
+++ b/tests/bplan/rules/test_rules_add_statement.py
@@ -7,6 +7,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.bplan import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_bplan.add_statement'
 
@@ -16,42 +17,60 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.StatementPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert not rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert not rules.has_perm(perm_name, initiator, module)
+        assert not rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_active(phase_factory, user):
+def test_active(phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.StatementPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase(phase_factory, user):
+def test_post_phase(phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.StatementPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert not rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert not rules.has_perm(perm_name, initiator, module)
+        assert not rules.has_perm(perm_name, admin, module)
diff --git a/tests/bplan/rules/test_rules_change.py b/tests/bplan/rules/test_rules_change.py
--- a/tests/bplan/rules/test_rules_change.py
+++ b/tests/bplan/rules/test_rules_change.py
@@ -7,7 +7,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.bplan import phases
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_bplan.change_bplan'
 
@@ -24,17 +24,20 @@ def test_pre_phase(phase_factory, user_factory, group_factory):
                                        phases.StatementPhase)
     anonymous, moderator, initiator = setup_users(project)
     user = user_factory()
-    group_member, _, project = setup_group_member(None, project,
-                                                  group_factory,
-                                                  user_factory)
+    admin = user_factory(is_superuser=True)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, project)
         assert not rules.has_perm(perm_name, user, project)
+        assert not rules.has_perm(perm_name, group_member_out, project)
+        assert not rules.has_perm(perm_name, group_member_in_org, project)
+        assert not rules.has_perm(perm_name, group_member_in_pro, project)
         assert not rules.has_perm(perm_name, moderator, project)
         assert rules.has_perm(perm_name, initiator, project)
-        assert not rules.has_perm(perm_name, group_member, project)
+        assert not rules.has_perm(perm_name, admin, project)
 
 
 @pytest.mark.django_db
@@ -43,17 +46,20 @@ def test_phase_active(phase_factory, user_factory, group_factory):
                                        phases.StatementPhase)
     anonymous, moderator, initiator = setup_users(project)
     user = user_factory()
-    group_member, _, project = setup_group_member(None, project,
-                                                  group_factory,
-                                                  user_factory)
+    admin = user_factory(is_superuser=True)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, project)
         assert not rules.has_perm(perm_name, user, project)
+        assert not rules.has_perm(perm_name, group_member_out, project)
+        assert not rules.has_perm(perm_name, group_member_in_org, project)
+        assert not rules.has_perm(perm_name, group_member_in_pro, project)
         assert not rules.has_perm(perm_name, moderator, project)
         assert rules.has_perm(perm_name, initiator, project)
-        assert not rules.has_perm(perm_name, group_member, project)
+        assert not rules.has_perm(perm_name, admin, project)
 
 
 @pytest.mark.django_db
@@ -64,16 +70,20 @@ def test_phase_active_project_draft(phase_factory, user_factory,
                                        module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     user = user_factory()
-    group_member, _, project = setup_group_member(None, project,
-                                                  group_factory,
-                                                  user_factory)
+    admin = user_factory(is_superuser=True)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, project)
         assert not rules.has_perm(perm_name, user, project)
+        assert not rules.has_perm(perm_name, group_member_out, project)
+        assert not rules.has_perm(perm_name, group_member_in_org, project)
+        assert not rules.has_perm(perm_name, group_member_in_pro, project)
         assert not rules.has_perm(perm_name, moderator, project)
         assert rules.has_perm(perm_name, initiator, project)
-        assert not rules.has_perm(perm_name, group_member, project)
+        assert not rules.has_perm(perm_name, admin, project)
 
 
 @pytest.mark.django_db
@@ -84,14 +94,17 @@ def test_post_phase_project_archived(phase_factory, user_factory,
                                        module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     user = user_factory()
-    group_member, _, project = setup_group_member(None, project,
-                                                  group_factory,
-                                                  user_factory)
+    admin = user_factory(is_superuser=True)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, project)
         assert not rules.has_perm(perm_name, user, project)
+        assert not rules.has_perm(perm_name, group_member_out, project)
+        assert not rules.has_perm(perm_name, group_member_in_org, project)
+        assert not rules.has_perm(perm_name, group_member_in_pro, project)
         assert not rules.has_perm(perm_name, moderator, project)
         assert rules.has_perm(perm_name, initiator, project)
-        assert not rules.has_perm(perm_name, group_member, project)
+        assert not rules.has_perm(perm_name, admin, project)
diff --git a/tests/budgeting/rules/test_rules_add.py b/tests/budgeting/rules/test_rules_add.py
--- a/tests/budgeting/rules/test_rules_add.py
+++ b/tests/budgeting/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.add_proposal'
 
@@ -17,124 +18,179 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(phase_factory, user):
+def test_request_phase_active(phase_factory, user, admin, user_factory,
+                              group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(phase_factory, user):
+def test_collect_phase_active(phase_factory, user, admin, user_factory,
+                              group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, user):
+def test_rating_phase_active(phase_factory, user, admin, user_factory,
+                             group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(phase_factory, user, admin,
+                                      user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, participant, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(phase_factory, user, admin,
+                                         user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, participant, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, user):
+def test_phase_active_project_draft(phase_factory, user, admin, user_factory,
+                                    group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase,
                                             module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(phase_factory, user, admin, user_factory,
+                                     group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/budgeting/rules/test_rules_change.py b/tests/budgeting/rules/test_rules_change.py
--- a/tests/budgeting/rules/test_rules_change.py
+++ b/tests/budgeting/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.change_proposal'
 
@@ -17,79 +18,114 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(phase_factory, proposal_factory, user):
+def test_request_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(phase_factory, proposal_factory, user):
+def test_collect_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -98,20 +134,27 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -120,39 +163,59 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/rules/test_rules_comment.py b/tests/budgeting/rules/test_rules_comment.py
--- a/tests/budgeting/rules/test_rules_comment.py
+++ b/tests/budgeting/rules/test_rules_comment.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.comment_proposal'
 
@@ -17,126 +18,204 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(phase_factory, proposal_factory, user):
+def test_request_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(phase_factory, proposal_factory, user):
+def test_collect_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/rules/test_rules_moderate.py b/tests/budgeting/rules/test_rules_moderate.py
--- a/tests/budgeting/rules/test_rules_moderate.py
+++ b/tests/budgeting/rules/test_rules_moderate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.moderate_proposal'
 
@@ -17,79 +18,114 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(phase_factory, proposal_factory, user):
+def test_request_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(phase_factory, proposal_factory, user):
+def test_collect_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -98,20 +134,27 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -120,39 +163,59 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/rules/test_rules_rate.py b/tests/budgeting/rules/test_rules_rate.py
--- a/tests/budgeting/rules/test_rules_rate.py
+++ b/tests/budgeting/rules/test_rules_rate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.rate_proposal'
 
@@ -17,132 +18,204 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(phase_factory, proposal_factory, user):
+def test_request_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(phase_factory, proposal_factory, user):
+def test_collect_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/rules/test_rules_support.py b/tests/budgeting/rules/test_rules_support.py
--- a/tests/budgeting/rules/test_rules_support.py
+++ b/tests/budgeting/rules/test_rules_support.py
@@ -11,6 +11,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.support_proposal'
 
@@ -20,38 +21,57 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user, admin):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_support_phase_active(phase_factory, proposal_factory, user, admin):
+def test_support_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.SupportPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_between_support_and_voting_phase(phase_factory, proposal_factory,
-                                          user, admin):
+def test_between_support_and_voting_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     support_phase, module, project, item = setup_phase(phase_factory,
                                                        proposal_factory,
                                                        phases.SupportPhase)
@@ -65,61 +85,94 @@ def test_between_support_and_voting_phase(phase_factory, proposal_factory,
     between_phases = support_phase.end_date + timedelta(hours=1)
 
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_time(between_phases):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_voting_phase_active(phase_factory, proposal_factory, user, admin):
+def test_voting_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.VotingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user, admin):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2, admin):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.SupportPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
@@ -127,20 +180,28 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2, admin):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.SupportPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
@@ -148,34 +209,50 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory,
-                                    user, admin):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.SupportPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory,
-                                     user, admin):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.SupportPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
         assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/rules/test_rules_view.py b/tests/budgeting/rules/test_rules_view.py
--- a/tests/budgeting/rules/test_rules_view.py
+++ b/tests/budgeting/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.view_proposal'
 
@@ -17,124 +18,202 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(phase_factory, proposal_factory, user):
+def test_request_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(phase_factory, proposal_factory, user):
+def test_collect_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/rules/test_rules_view_support.py b/tests/budgeting/rules/test_rules_view_support.py
--- a/tests/budgeting/rules/test_rules_view_support.py
+++ b/tests/budgeting/rules/test_rules_view_support.py
@@ -11,6 +11,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.view_support'
 
@@ -20,38 +21,53 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user, admin):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_support_phase_active(phase_factory, proposal_factory, user, admin):
+def test_support_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.SupportPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_between_support_and_voting_phase(phase_factory, proposal_factory,
-                                          user, admin):
+def test_between_support_and_voting_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     support_phase, module, project, item = setup_phase(phase_factory,
                                                        proposal_factory,
                                                        phases.SupportPhase)
@@ -65,61 +81,86 @@ def test_between_support_and_voting_phase(phase_factory, proposal_factory,
     between_phases = support_phase.end_date + timedelta(hours=1)
 
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_time(between_phases):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_voting_phase_active(phase_factory, proposal_factory, user, admin):
+def test_voting_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.VotingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(phase_factory, proposal_factory, user, admin):
+def test_rating_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2, admin):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(
         phase_factory, proposal_factory, phases.SupportPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, participant, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
@@ -127,20 +168,26 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2, admin):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(
         phase_factory, proposal_factory, phases.SupportPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, participant, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
@@ -148,35 +195,47 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user,
-                                    admin):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(phase_factory, proposal_factory,
                                                phases.SupportPhase,
                                                module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user,
-                                     admin):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, module, project, item = setup_phase(
         phase_factory, proposal_factory,
         phases.SupportPhase,
         module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
         assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/budgeting/rules/test_rules_vote.py b/tests/budgeting/rules/test_rules_vote.py
--- a/tests/budgeting/rules/test_rules_vote.py
+++ b/tests/budgeting/rules/test_rules_vote.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_budgeting.vote_proposal'
 
@@ -20,186 +21,257 @@ def test_perm_exists():
 # I guess the permissions aren't completely tested by testing the rules here
 # b/c the existing rule only checks for the phase being active...
 @pytest.mark.django_db
-def test_pre_phase(user_factory, phase_factory, proposal_factory, user):
-    phase, _, project, proposal = setup_phase(phase_factory, proposal_factory,
-                                              phases.RequestPhase)
+def test_pre_phase(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
+        phase_factory, proposal_factory, phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_request_phase_active(user_factory, phase_factory, proposal_factory,
-                              user):
-    phase, _, project, proposal = setup_phase(phase_factory, proposal_factory,
-                                              phases.RequestPhase)
+def test_request_phase_active(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
+        phase_factory, proposal_factory, phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_collect_phase_active(user_factory, phase_factory, proposal_factory,
-                              user):
-    phase, _, project, proposal = setup_phase(phase_factory, proposal_factory,
-                                              phases.CollectPhase)
+def test_collect_phase_active(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
+        phase_factory, proposal_factory, phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_rating_phase_active(user_factory, phase_factory, proposal_factory,
-                             user):
-    phase, _, project, proposal = setup_phase(phase_factory, proposal_factory,
-                                              phases.RatingPhase)
+def test_rating_phase_active(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
+        phase_factory, proposal_factory, phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_voting_phase_active(user_factory, phase_factory, proposal_factory,
-                             user):
-    phase, _, project, proposal = setup_phase(phase_factory, proposal_factory,
-                                              phases.VotingPhase)
+def test_voting_phase_active(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
+        phase_factory, proposal_factory, phases.VotingPhase)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
-        assert rules.has_perm(perm_name, anonymous, proposal)
-        assert rules.has_perm(perm_name, user, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
-        assert rules.has_perm(perm_name, moderator, proposal)
-        assert rules.has_perm(perm_name, initiator, proposal)
+        assert rules.has_perm(perm_name, anonymous, item)
+        assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
+        assert rules.has_perm(perm_name, moderator, item)
+        assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(user_factory, phase_factory,
-                                      proposal_factory, user, user2):
-    phase, _, project, proposal = setup_phase(
+def test_phase_active_project_private(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.VotingPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
-        assert rules.has_perm(perm_name, anonymous, proposal)
-        assert rules.has_perm(perm_name, user, proposal)
-        assert rules.has_perm(perm_name, participant, proposal)
-        assert rules.has_perm(perm_name, moderator, proposal)
-        assert rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert rules.has_perm(perm_name, anonymous, item)
+        assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
+        assert rules.has_perm(perm_name, moderator, item)
+        assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(user_factory, phase_factory,
-                                         proposal_factory, user, user2):
-    phase, _, project, proposal = setup_phase(
+def test_phase_active_project_semipublic(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.VotingPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
-        assert rules.has_perm(perm_name, anonymous, proposal)
-        assert rules.has_perm(perm_name, user, proposal)
-        assert rules.has_perm(perm_name, participant, proposal)
-        assert rules.has_perm(perm_name, moderator, proposal)
-        assert rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert rules.has_perm(perm_name, anonymous, item)
+        assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
+        assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, moderator, item)
+        assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(user_factory, phase_factory,
-                                    proposal_factory, user):
-    phase, _, project, proposal = setup_phase(
+def test_phase_active_project_draft(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.VotingPhase,
         module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(user_factory, phase_factory,
-                                     proposal_factory, user):
-    phase, _, project, proposal = setup_phase(
+def test_post_phase_project_archived(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.VotingPhase,
         module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_proposal_archived(user_factory, phase_factory,
-                                        proposal_factory, user):
-    phase, _, project, proposal = setup_phase(
+def test_phase_active_proposal_archived(
+        user_factory, phase_factory, proposal_factory, user, admin,
+        group_factory):
+    phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.VotingPhase,
         module__project__is_draft=True)
 
-    proposal.is_archived = True
-    proposal.save()
+    item.is_archived = True
+    item.save()
 
     anonymous, moderator, initiator = setup_users(project)
-    admin = user_factory(is_superuser=True)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
-        assert not rules.has_perm(perm_name, anonymous, proposal)
-        assert not rules.has_perm(perm_name, user, proposal)
-        assert not rules.has_perm(perm_name, moderator, proposal)
-        assert not rules.has_perm(perm_name, initiator, proposal)
-        assert rules.has_perm(perm_name, admin, proposal)
+        assert not rules.has_perm(perm_name, anonymous, item)
+        assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
+        assert not rules.has_perm(perm_name, moderator, item)
+        assert not rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/budgeting/test_proposals_api_filtering.py b/tests/budgeting/test_proposals_api_filtering.py
--- a/tests/budgeting/test_proposals_api_filtering.py
+++ b/tests/budgeting/test_proposals_api_filtering.py
@@ -11,7 +11,6 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.budgeting import phases
-from meinberlin.test.helpers import setup_group_member
 
 
 @pytest.mark.django_db
@@ -19,16 +18,17 @@ def test_proposal_list_filter_mixin(apiclient, user_factory, group_factory,
                                     phase_factory, proposal_factory,
                                     category_factory, label_factory,
                                     moderation_task_factory):
-    support_phase, module, project, proposal = setup_phase(phase_factory,
-                                                           proposal_factory,
-                                                           phases.SupportPhase)
+    support_phase, module, project, proposal = setup_phase(
+        phase_factory, proposal_factory, phases.SupportPhase
+    )
     user = user_factory()
-    group_member, organisation, project = setup_group_member(None, project,
-                                                             group_factory,
-                                                             user_factory)
-
     anonymous, moderator, initiator = setup_users(project)
 
+    group_pro = group_factory()
+    project.group = group_pro
+    project.save()
+    group_member = user_factory.create(groups=(group_pro, ))
+
     voting_phase = phase_factory(
         phase_content=phases.VotingPhase(),
         module=module,
diff --git a/tests/documents/rules/test_rules_add_chapter.py b/tests/documents/rules/test_rules_add_chapter.py
--- a/tests/documents/rules/test_rules_add_chapter.py
+++ b/tests/documents/rules/test_rules_add_chapter.py
@@ -8,7 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.documents import phases
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_documents.add_chapter'
 
@@ -24,17 +24,17 @@ def test_pre_phase(phase_factory, user_factory,
                                             phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
-        assert not rules.has_perm(perm_name, group_member_in_orga, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
         assert not rules.has_perm(perm_name, group_member_out, module)
         assert not rules.has_perm(perm_name, moderator, module)
-        assert rules.has_perm(perm_name, group_member_in_project, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, initiator, module)
 
 
@@ -45,17 +45,17 @@ def test_phase_active(phase_factory, user_factory,
                                             phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
-        assert not rules.has_perm(perm_name, group_member_in_orga, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
         assert not rules.has_perm(perm_name, group_member_out, module)
         assert not rules.has_perm(perm_name, moderator, module)
-        assert rules.has_perm(perm_name, group_member_in_project, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, initiator, module)
 
 
@@ -69,18 +69,18 @@ def test_phase_active_project_private(phase_factory, user_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert not rules.has_perm(perm_name, participant, module)
-        assert not rules.has_perm(perm_name, group_member_in_orga, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
         assert not rules.has_perm(perm_name, group_member_out, module)
         assert not rules.has_perm(perm_name, moderator, module)
-        assert rules.has_perm(perm_name, group_member_in_project, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, initiator, module)
 
 
@@ -94,18 +94,18 @@ def test_phase_active_project_semipublic(phase_factory, user_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert not rules.has_perm(perm_name, participant, module)
-        assert not rules.has_perm(perm_name, group_member_in_orga, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
         assert not rules.has_perm(perm_name, group_member_out, module)
         assert not rules.has_perm(perm_name, moderator, module)
-        assert rules.has_perm(perm_name, group_member_in_project, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, initiator, module)
 
 
@@ -117,17 +117,17 @@ def test_phase_active_project_draft(phase_factory, user_factory,
                                             module__project__is_draft=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
-        assert not rules.has_perm(perm_name, group_member_in_orga, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
         assert not rules.has_perm(perm_name, group_member_out, module)
         assert not rules.has_perm(perm_name, moderator, module)
-        assert rules.has_perm(perm_name, group_member_in_project, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, initiator, module)
 
 
@@ -139,15 +139,15 @@ def test_post_phase_project_archived(phase_factory, user_factory,
                                             module__project__is_archived=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
-        assert not rules.has_perm(perm_name, group_member_in_orga, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
         assert not rules.has_perm(perm_name, group_member_out, module)
         assert not rules.has_perm(perm_name, moderator, module)
-        assert rules.has_perm(perm_name, group_member_in_project, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, initiator, module)
diff --git a/tests/documents/rules/test_rules_change_chapter.py b/tests/documents/rules/test_rules_change_chapter.py
--- a/tests/documents/rules/test_rules_change_chapter.py
+++ b/tests/documents/rules/test_rules_change_chapter.py
@@ -8,7 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.documents import phases
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_documents.change_chapter'
 
@@ -27,18 +27,18 @@ def test_pre_phase(phase_factory, chapter_factory,
 
     creator = item.creator
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
         assert not rules.has_perm(perm_name, moderator, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, initiator, item)
 
 
@@ -51,18 +51,18 @@ def test_phase_active(phase_factory, chapter_factory,
 
     creator = item.creator
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
         assert not rules.has_perm(perm_name, moderator, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, initiator, item)
 
 
@@ -78,8 +78,8 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
@@ -87,10 +87,10 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
         assert not rules.has_perm(perm_name, moderator, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, initiator, item)
 
 
@@ -106,8 +106,8 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
@@ -115,10 +115,10 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
         assert not rules.has_perm(perm_name, moderator, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, initiator, item)
 
 
@@ -132,18 +132,18 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
 
     creator = item.creator
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
         assert not rules.has_perm(perm_name, moderator, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, initiator, item)
 
 
@@ -157,16 +157,16 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
 
     creator = item.creator
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
         assert not rules.has_perm(perm_name, moderator, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, initiator, item)
diff --git a/tests/documents/rules/test_rules_comment_chapter.py b/tests/documents/rules/test_rules_comment_chapter.py
--- a/tests/documents/rules/test_rules_comment_chapter.py
+++ b/tests/documents/rules/test_rules_comment_chapter.py
@@ -8,7 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.documents import phases
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_documents.comment_chapter'
 
@@ -24,16 +24,18 @@ def test_pre_phase(phase_factory, chapter_factory, user_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
 
@@ -45,16 +47,18 @@ def test_phase_active(phase_factory, chapter_factory, user_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
-        assert rules.has_perm(perm_name, group_member_in_orga, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
         assert rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
 
@@ -70,16 +74,18 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
@@ -96,16 +102,18 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
@@ -120,16 +128,18 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
                                           module__project__is_draft=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
 
@@ -144,15 +154,17 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
                                           module__project__is_archived=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
diff --git a/tests/documents/rules/test_rules_comment_paragraph.py b/tests/documents/rules/test_rules_comment_paragraph.py
--- a/tests/documents/rules/test_rules_comment_paragraph.py
+++ b/tests/documents/rules/test_rules_comment_paragraph.py
@@ -8,7 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.documents import phases
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_documents.comment_paragraph'
 
@@ -24,8 +24,9 @@ def test_pre_phase(phase_factory, chapter_factory, paragraph_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -33,9 +34,10 @@ def test_pre_phase(phase_factory, chapter_factory, paragraph_factory,
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
 
@@ -47,8 +49,9 @@ def test_phase_active(phase_factory, chapter_factory, paragraph_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -56,9 +59,10 @@ def test_phase_active(phase_factory, chapter_factory, paragraph_factory,
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert rules.has_perm(perm_name, user, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert rules.has_perm(perm_name, creator, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
 
@@ -74,8 +78,9 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -83,9 +88,10 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, participant, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
@@ -102,8 +108,9 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -111,9 +118,10 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, participant, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
@@ -128,8 +136,9 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
         module__project__is_draft=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -137,9 +146,10 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
 
@@ -153,8 +163,9 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
                                           module__project__is_archived=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -162,8 +173,9 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
diff --git a/tests/documents/rules/test_rules_view_chapter.py b/tests/documents/rules/test_rules_view_chapter.py
--- a/tests/documents/rules/test_rules_view_chapter.py
+++ b/tests/documents/rules/test_rules_view_chapter.py
@@ -8,7 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.documents import phases
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_documents.view_chapter'
 
@@ -25,16 +25,18 @@ def test_pre_phase(phase_factory, chapter_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
-        assert rules.has_perm(perm_name, group_member_in_orga, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
         assert rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
 
@@ -46,16 +48,18 @@ def test_phase_active(phase_factory, chapter_factory,
     phase, _, project, item = setup_phase(phase_factory, chapter_factory,
                                           phases.CommentPhase)
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
-        assert rules.has_perm(perm_name, group_member_in_orga, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
         assert rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
 
@@ -71,16 +75,18 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
@@ -97,16 +103,18 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
-        assert rules.has_perm(perm_name, group_member_in_orga, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
         assert rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, participant, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
@@ -121,16 +129,18 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
                                           module__project__is_draft=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
-        assert not rules.has_perm(perm_name, group_member_in_orga, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
         assert not rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
 
@@ -144,15 +154,17 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
                                           module__project__is_archived=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
-        assert rules.has_perm(perm_name, group_member_in_orga, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
         assert rules.has_perm(perm_name, group_member_out, item)
-        assert rules.has_perm(perm_name, group_member_in_project, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
diff --git a/tests/documents/rules/test_rules_view_paragraph.py b/tests/documents/rules/test_rules_view_paragraph.py
--- a/tests/documents/rules/test_rules_view_paragraph.py
+++ b/tests/documents/rules/test_rules_view_paragraph.py
@@ -8,7 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.documents import phases
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_documents.view_paragraph'
 
@@ -25,8 +25,9 @@ def test_pre_phase(phase_factory, chapter_factory, paragraph_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -34,9 +35,10 @@ def test_pre_phase(phase_factory, chapter_factory, paragraph_factory,
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, paragraph)
         assert rules.has_perm(perm_name, user, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert rules.has_perm(perm_name, creator, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
 
@@ -49,8 +51,9 @@ def test_phase_active(phase_factory, chapter_factory, paragraph_factory,
                                           phases.CommentPhase)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -58,9 +61,10 @@ def test_phase_active(phase_factory, chapter_factory, paragraph_factory,
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, paragraph)
         assert rules.has_perm(perm_name, user, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert rules.has_perm(perm_name, creator, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
 
@@ -77,8 +81,9 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -86,9 +91,10 @@ def test_phase_active_project_private(phase_factory, chapter_factory,
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, participant, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
@@ -106,8 +112,9 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     anonymous, moderator, initiator = setup_users(project)
     participant = user_factory()
     project.participants.add(participant)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -115,9 +122,10 @@ def test_phase_active_project_semipublic(phase_factory, chapter_factory,
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, paragraph)
         assert rules.has_perm(perm_name, user, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert rules.has_perm(perm_name, creator, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, participant, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
@@ -133,8 +141,9 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
                                           module__project__is_draft=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -142,9 +151,10 @@ def test_phase_active_project_draft(phase_factory, chapter_factory,
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, paragraph)
         assert not rules.has_perm(perm_name, user, paragraph)
-        assert not rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert not rules.has_perm(perm_name, creator, paragraph)
+        assert not rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert not rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
 
@@ -159,8 +169,9 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
                                           module__project__is_archived=True)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     paragraph = paragraph_factory(chapter=item)
 
@@ -168,8 +179,9 @@ def test_post_phase_project_archived(phase_factory, chapter_factory,
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, paragraph)
         assert rules.has_perm(perm_name, user, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_orga, paragraph)
+        assert rules.has_perm(perm_name, creator, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_org, paragraph)
         assert rules.has_perm(perm_name, group_member_out, paragraph)
-        assert rules.has_perm(perm_name, group_member_in_project, paragraph)
+        assert rules.has_perm(perm_name, group_member_in_pro, paragraph)
         assert rules.has_perm(perm_name, moderator, paragraph)
         assert rules.has_perm(perm_name, initiator, paragraph)
diff --git a/tests/extprojects/dashboard_components/test_views_extproject_basic.py b/tests/extprojects/dashboard_components/test_views_extproject_basic.py
--- a/tests/extprojects/dashboard_components/test_views_extproject_basic.py
+++ b/tests/extprojects/dashboard_components/test_views_extproject_basic.py
@@ -5,7 +5,7 @@
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.apps.extprojects.phases import ExternalPhase
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('external')
 
@@ -55,13 +55,13 @@ def test_edit_view(client, phase_factory, external_project, module_factory):
 def test_edit_view_group_member(
         client, phase_factory, external_project,
         module_factory, group_factory, user_factory):
-    group_member, organisation, external_project = setup_group_member(
-        None, external_project, group_factory, user_factory)
+    project, _, group_member_in_pro, _ = \
+        setup_group_members(external_project, group_factory, user_factory)
     module = module_factory(project=external_project)
     phase = phase_factory(phase_content=ExternalPhase(), module=module)
 
     url = component.get_base_url(external_project)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/extprojects/dashboard_components/test_views_extproject_plans.py b/tests/extprojects/dashboard_components/test_views_extproject_plans.py
--- a/tests/extprojects/dashboard_components/test_views_extproject_plans.py
+++ b/tests/extprojects/dashboard_components/test_views_extproject_plans.py
@@ -3,7 +3,7 @@
 from adhocracy4.dashboard import components
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('plans')
 
@@ -34,11 +34,12 @@ def test_edit_view(client, external_project, plan_factory):
 def test_edit_view_group_member(
         client, external_project, plan_factory, group_factory,
         user_factory):
-    group_member, organisation, external_project = setup_group_member(
-        None, external_project, group_factory, user_factory)
+    external_project, _, group_member_in_pro, _ = \
+        setup_group_members(external_project, group_factory, user_factory)
+    organisation = external_project.organisation
     plan = plan_factory(organisation=organisation)
     url = component.get_base_url(external_project)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/extprojects/dashboard_components/test_views_extproject_point.py b/tests/extprojects/dashboard_components/test_views_extproject_point.py
--- a/tests/extprojects/dashboard_components/test_views_extproject_point.py
+++ b/tests/extprojects/dashboard_components/test_views_extproject_point.py
@@ -5,7 +5,7 @@
 from adhocracy4.dashboard import components
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('point')
 
@@ -43,10 +43,10 @@ def test_edit_view(client, external_project, administrative_district):
 def test_edit_view_group_member(
         client, external_project, administrative_district,
         group_factory, user_factory):
-    group_member, _, external_project = setup_group_member(
-        None, external_project, group_factory, user_factory)
+    external_project, _, group_member_in_pro, _ = \
+        setup_group_members(external_project, group_factory, user_factory)
     url = component.get_base_url(external_project)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/extprojects/dashboard_components/test_views_extproject_topics.py b/tests/extprojects/dashboard_components/test_views_extproject_topics.py
--- a/tests/extprojects/dashboard_components/test_views_extproject_topics.py
+++ b/tests/extprojects/dashboard_components/test_views_extproject_topics.py
@@ -4,7 +4,7 @@
 from adhocracy4.dashboard import components
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('topics')
 
@@ -33,10 +33,10 @@ def test_edit_view(client, external_project):
 @pytest.mark.django_db
 def test_edit_view_gourp_member(client, external_project, group_factory,
                                 user_factory):
-    group_member, _, external_project = setup_group_member(
-        None, external_project, group_factory, user_factory)
+    external_project, _, group_member_in_pro, _ = \
+        setup_group_members(external_project, group_factory, user_factory)
     url = component.get_base_url(external_project)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/helpers.py b/tests/helpers.py
--- a/tests/helpers.py
+++ b/tests/helpers.py
@@ -12,19 +12,3 @@ def __eq__(self, actual):
 
     def __repr__(self):
         return self._regex.pattern
-
-
-def setup_group_users(user_factory, group_factory, project):
-    group1 = group_factory()
-    group2 = group_factory()
-    group3 = group_factory()
-    group_member_in_orga = user_factory.create(groups=(group1, group2))
-    group_member_out = user_factory.create(groups=(group2,))
-    group_member_in_project = user_factory.create(groups=(group2, group3))
-
-    project.organisation.groups.add(group1)
-    project.group = group3
-    project.save()
-
-    return group_member_in_orga, group_member_out, group_member_in_project, \
-        project
diff --git a/tests/ideas/rules/test_rules_add.py b/tests/ideas/rules/test_rules_add.py
--- a/tests/ideas/rules/test_rules_add.py
+++ b/tests/ideas/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.ideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_ideas.add_idea'
 
@@ -17,41 +18,58 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, user):
+def test_phase_active(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +77,25 @@ def test_phase_active_project_private(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +103,53 @@ def test_phase_active_project_semipublic(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase,
                                             module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/ideas/rules/test_rules_change.py b/tests/ideas/rules/test_rules_change.py
--- a/tests/ideas/rules/test_rules_change.py
+++ b/tests/ideas/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.ideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_ideas.change_idea'
 
@@ -17,47 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, idea_factory, user):
+def test_pre_phase(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, idea_factory, user):
+def test_phase_active(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +86,27 @@ def test_phase_active_project_private(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +115,59 @@ def test_phase_active_project_semipublic(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/ideas/rules/test_rules_comment.py b/tests/ideas/rules/test_rules_comment.py
--- a/tests/ideas/rules/test_rules_comment.py
+++ b/tests/ideas/rules/test_rules_comment.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.ideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_ideas.comment_idea'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, idea_factory, user):
+def test_pre_phase(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, idea_factory, user):
+def test_phase_active(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/ideas/rules/test_rules_moderate.py b/tests/ideas/rules/test_rules_moderate.py
--- a/tests/ideas/rules/test_rules_moderate.py
+++ b/tests/ideas/rules/test_rules_moderate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.ideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_ideas.moderate_idea'
 
@@ -17,47 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, idea_factory, user):
+def test_pre_phase(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, idea_factory, user):
+def test_phase_active(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +86,27 @@ def test_phase_active_project_private(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +115,59 @@ def test_phase_active_project_semipublic(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
diff --git a/tests/ideas/rules/test_rules_view.py b/tests/ideas/rules/test_rules_view.py
--- a/tests/ideas/rules/test_rules_view.py
+++ b/tests/ideas/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.ideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_ideas.view_idea'
 
@@ -17,41 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, idea_factory, user):
+def test_pre_phase(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, idea_factory, user):
+def test_phase_active(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +85,28 @@ def test_phase_active_project_private(phase_factory, idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, idea_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/kiezkasse/rules/test_rules_add.py b/tests/kiezkasse/rules/test_rules_add.py
--- a/tests/kiezkasse/rules/test_rules_add.py
+++ b/tests/kiezkasse/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.kiezkasse import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_kiezkasse.add_proposal'
 
@@ -17,60 +18,84 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, user):
+def test_phase_active(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, participant, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +103,53 @@ def test_phase_active_project_semipublic(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase,
                                             module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.RequestPhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/kiezkasse/rules/test_rules_change.py b/tests/kiezkasse/rules/test_rules_change.py
--- a/tests/kiezkasse/rules/test_rules_change.py
+++ b/tests/kiezkasse/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.kiezkasse import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_kiezkasse.change_proposal'
 
@@ -17,47 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, proposal_factory, user):
+def test_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +86,27 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +115,59 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/kiezkasse/rules/test_rules_comment.py b/tests/kiezkasse/rules/test_rules_comment.py
--- a/tests/kiezkasse/rules/test_rules_comment.py
+++ b/tests/kiezkasse/rules/test_rules_comment.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.kiezkasse import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_kiezkasse.comment_proposal'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, proposal_factory, user):
+def test_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/kiezkasse/rules/test_rules_moderate.py b/tests/kiezkasse/rules/test_rules_moderate.py
--- a/tests/kiezkasse/rules/test_rules_moderate.py
+++ b/tests/kiezkasse/rules/test_rules_moderate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.kiezkasse import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_kiezkasse.moderate_proposal'
 
@@ -17,47 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, proposal_factory, user):
+def test_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +86,27 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +115,59 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
diff --git a/tests/kiezkasse/rules/test_rules_rate.py b/tests/kiezkasse/rules/test_rules_rate.py
--- a/tests/kiezkasse/rules/test_rules_rate.py
+++ b/tests/kiezkasse/rules/test_rules_rate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.kiezkasse import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_kiezkasse.rate_proposal'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.FeedbackPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, proposal_factory, user):
+def test_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.FeedbackPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.FeedbackPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.FeedbackPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.FeedbackPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.FeedbackPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/kiezkasse/rules/test_rules_view.py b/tests/kiezkasse/rules/test_rules_view.py
--- a/tests/kiezkasse/rules/test_rules_view.py
+++ b/tests/kiezkasse/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.kiezkasse import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_kiezkasse.view_proposal'
 
@@ -17,41 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, proposal_factory, user):
+def test_pre_phase(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, proposal_factory, user):
+def test_phase_active(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, proposal_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +84,27 @@ def test_phase_active_project_private(phase_factory, proposal_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, proposal_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, proposal_factory, phases.RequestPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +112,60 @@ def test_phase_active_project_semipublic(phase_factory, proposal_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, proposal_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, proposal_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, proposal_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, proposal_factory,
                                           phases.RequestPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/livequestions/rules/test_rules_add.py b/tests/livequestions/rules/test_rules_add.py
--- a/tests/livequestions/rules/test_rules_add.py
+++ b/tests/livequestions/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.livequestions import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_livequestions.add_livequestion'
 
@@ -17,41 +18,58 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert not rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert not rules.has_perm(perm_name, initiator, module)
+        assert not rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, user):
+def test_phase_active(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.IssuePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +77,25 @@ def test_phase_active_project_private(phase_factory, user, user2):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.IssuePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,20 +103,31 @@ def test_phase_active_project_semipublic(phase_factory, user, user2):
         assert rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.IssuePhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert not rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert not rules.has_perm(perm_name, initiator, module)
+        assert not rules.has_perm(perm_name, admin, module)
diff --git a/tests/livequestions/rules/test_rules_change.py b/tests/livequestions/rules/test_rules_change.py
--- a/tests/livequestions/rules/test_rules_change.py
+++ b/tests/livequestions/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.livequestions import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_livequestions.change_livequestion'
 
@@ -17,100 +18,152 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, live_question_factory, user):
+def test_pre_phase(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, live_question_factory, user):
+def test_phase_active(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory,
-                                      live_question_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, live_question_factory, phases.IssuePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory,
-                                         live_question_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, live_question_factory, phases.IssuePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory,
-                                    live_question_factory,
-                                    user):
+def test_phase_active_project_draft(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory,
-                                     live_question_factory,
-                                     user):
+def test_post_phase_project_archived(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/livequestions/rules/test_rules_moderate.py b/tests/livequestions/rules/test_rules_moderate.py
--- a/tests/livequestions/rules/test_rules_moderate.py
+++ b/tests/livequestions/rules/test_rules_moderate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.livequestions import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_livequestions.moderate_livequestions'
 
@@ -17,42 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, live_question_factory, user):
+def test_pre_phase(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, live_question_factory, user):
+def test_phase_active(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory,
-                                      live_question_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, live_question_factory, phases.IssuePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +84,27 @@ def test_phase_active_project_private(phase_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory,
-                                         live_question_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, live_question_factory, phases.IssuePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,39 +112,60 @@ def test_phase_active_project_semipublic(phase_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory,
-                                    live_question_factory,
-                                    user):
+def test_phase_active_project_draft(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory,
-                                     live_question_factory,
-                                     user):
+def test_post_phase_project_archived(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/livequestions/rules/test_rules_view.py b/tests/livequestions/rules/test_rules_view.py
--- a/tests/livequestions/rules/test_rules_view.py
+++ b/tests/livequestions/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.livequestions import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_livequestions.view_livequestion'
 
@@ -17,41 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, live_question_factory, user):
+def test_pre_phase(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, live_question_factory, user):
+def test_phase_active(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, live_question_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, live_question_factory, phases.IssuePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +84,27 @@ def test_phase_active_project_private(phase_factory, live_question_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, live_question_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, live_question_factory, phases.IssuePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,22 +112,35 @@ def test_phase_active_project_semipublic(phase_factory, live_question_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory,
-                                     live_question_factory,
-                                     user):
+def test_post_phase_project_archived(
+        phase_factory, live_question_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, live_question_factory,
                                           phases.IssuePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/mapideas/rules/test_rules_add.py b/tests/mapideas/rules/test_rules_add.py
--- a/tests/mapideas/rules/test_rules_add.py
+++ b/tests/mapideas/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.mapideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_mapideas.add_mapidea'
 
@@ -17,41 +18,58 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, user):
+def test_phase_active(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert rules.has_perm(perm_name, user, module)
+        assert rules.has_perm(perm_name, group_member_out, module)
+        assert rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +77,25 @@ def test_phase_active_project_private(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +103,53 @@ def test_phase_active_project_semipublic(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase,
                                             module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.CollectPhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/mapideas/rules/test_rules_change.py b/tests/mapideas/rules/test_rules_change.py
--- a/tests/mapideas/rules/test_rules_change.py
+++ b/tests/mapideas/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.mapideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_mapideas.change_mapidea'
 
@@ -17,47 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, map_idea_factory, user):
+def test_pre_phase(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, map_idea_factory, user):
+def test_phase_active(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, map_idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +86,27 @@ def test_phase_active_project_private(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +115,59 @@ def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, map_idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, map_idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/mapideas/rules/test_rules_comment.py b/tests/mapideas/rules/test_rules_comment.py
--- a/tests/mapideas/rules/test_rules_comment.py
+++ b/tests/mapideas/rules/test_rules_comment.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.mapideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_mapideas.comment_mapidea'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, map_idea_factory, user):
+def test_pre_phase(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, map_idea_factory, user):
+def test_phase_active(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, map_idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, map_idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, map_idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/mapideas/rules/test_rules_moderate.py b/tests/mapideas/rules/test_rules_moderate.py
--- a/tests/mapideas/rules/test_rules_moderate.py
+++ b/tests/mapideas/rules/test_rules_moderate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.mapideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_mapideas.moderate_mapidea'
 
@@ -17,47 +18,69 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, map_idea_factory, user):
+def test_pre_phase(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, map_idea_factory, user):
+def test_phase_active(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, map_idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +89,28 @@ def test_phase_active_project_private(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +119,61 @@ def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, map_idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, map_idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    creator = item.creator
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert not rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert not rules.has_perm(perm_name, admin, item)
diff --git a/tests/mapideas/rules/test_rules_rate.py b/tests/mapideas/rules/test_rules_rate.py
--- a/tests/mapideas/rules/test_rules_rate.py
+++ b/tests/mapideas/rules/test_rules_rate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.mapideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_mapideas.rate_mapidea'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, map_idea_factory, user):
+def test_pre_phase(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, map_idea_factory, user):
+def test_phase_active(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.RatingPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, map_idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.RatingPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.RatingPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, map_idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.RatingPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, map_idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.RatingPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/mapideas/rules/test_rules_view.py b/tests/mapideas/rules/test_rules_view.py
--- a/tests/mapideas/rules/test_rules_view.py
+++ b/tests/mapideas/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.mapideas import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_mapideas.view_mapidea'
 
@@ -17,41 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, map_idea_factory, user):
+def test_pre_phase(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, map_idea_factory, user):
+def test_phase_active(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, map_idea_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +84,27 @@ def test_phase_active_project_private(phase_factory, map_idea_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, map_idea_factory, phases.CollectPhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +112,60 @@ def test_phase_active_project_semipublic(phase_factory, map_idea_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, map_idea_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, map_idea_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, map_idea_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, map_idea_factory,
                                           phases.CollectPhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/maptopicprio/rules/test_rules_add.py b/tests/maptopicprio/rules/test_rules_add.py
--- a/tests/maptopicprio/rules/test_rules_add.py
+++ b/tests/maptopicprio/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.maptopicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_maptopicprio.add_maptopic'
 
@@ -17,41 +18,58 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, user):
+def test_phase_active(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +77,25 @@ def test_phase_active_project_private(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert not rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +103,53 @@ def test_phase_active_project_semipublic(phase_factory, user, user2):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
         assert not rules.has_perm(perm_name, participant, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase,
                                             module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/maptopicprio/rules/test_rules_change.py b/tests/maptopicprio/rules/test_rules_change.py
--- a/tests/maptopicprio/rules/test_rules_change.py
+++ b/tests/maptopicprio/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.maptopicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_maptopicprio.change_maptopic'
 
@@ -17,46 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, maptopic_factory, user):
+def test_pre_phase(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, maptopic_factory, user):
+def test_phase_active(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, maptopic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
-    participant = user2
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -65,19 +85,26 @@ def test_phase_active_project_private(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
-    participant = user2
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -86,39 +113,59 @@ def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, maptopic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, maptopic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/maptopicprio/rules/test_rules_comment.py b/tests/maptopicprio/rules/test_rules_comment.py
--- a/tests/maptopicprio/rules/test_rules_comment.py
+++ b/tests/maptopicprio/rules/test_rules_comment.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.maptopicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_maptopicprio.comment_maptopic'
 
@@ -17,41 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, maptopic_factory, user):
+def test_pre_phase(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, maptopic_factory, user):
+def test_phase_active(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, maptopic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +84,27 @@ def test_phase_active_project_private(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +112,60 @@ def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, maptopic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, maptopic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/maptopicprio/rules/test_rules_rate.py b/tests/maptopicprio/rules/test_rules_rate.py
--- a/tests/maptopicprio/rules/test_rules_rate.py
+++ b/tests/maptopicprio/rules/test_rules_rate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.maptopicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_maptopicprio.rate_maptopic'
 
@@ -17,41 +18,65 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, maptopic_factory, user):
+def test_pre_phase(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, maptopic_factory, user):
+def test_phase_active(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, maptopic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +84,27 @@ def test_phase_active_project_private(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +112,60 @@ def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, maptopic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, maptopic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/maptopicprio/rules/test_rules_view.py b/tests/maptopicprio/rules/test_rules_view.py
--- a/tests/maptopicprio/rules/test_rules_view.py
+++ b/tests/maptopicprio/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.maptopicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_maptopicprio.view_maptopic'
 
@@ -17,41 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, maptopic_factory, user):
+def test_pre_phase(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, maptopic_factory, user):
+def test_phase_active(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, maptopic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -59,18 +85,28 @@ def test_phase_active_project_private(phase_factory, maptopic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, maptopic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -78,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, maptopic_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, maptopic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, maptopic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, maptopic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, maptopic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/offlineevents/rules/test_rules_add.py b/tests/offlineevents/rules/test_rules_add.py
--- a/tests/offlineevents/rules/test_rules_add.py
+++ b/tests/offlineevents/rules/test_rules_add.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_offlineevents.add_offlineevent'
 
@@ -18,13 +18,13 @@ def test_rule(offline_event, user_factory, group_factory,
     project = offline_event.project
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, project)
     assert not rules.has_perm(perm_name, user, project)
-    assert not rules.has_perm(perm_name, group_member_in_orga, project)
+    assert not rules.has_perm(perm_name, group_member_in_org, project)
     assert not rules.has_perm(perm_name, group_member_out, project)
     assert not rules.has_perm(perm_name, moderator, project)
-    assert rules.has_perm(perm_name, group_member_in_project, project)
+    assert rules.has_perm(perm_name, group_member_in_pro, project)
     assert rules.has_perm(perm_name, initiator, project)
diff --git a/tests/offlineevents/rules/test_rules_change.py b/tests/offlineevents/rules/test_rules_change.py
--- a/tests/offlineevents/rules/test_rules_change.py
+++ b/tests/offlineevents/rules/test_rules_change.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_offlineevents.change_offlineevent'
 
@@ -18,13 +18,13 @@ def test_rule(offline_event, user_factory, group_factory,
     project = offline_event.project
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, project)
     assert not rules.has_perm(perm_name, user, project)
-    assert not rules.has_perm(perm_name, group_member_in_orga, project)
+    assert not rules.has_perm(perm_name, group_member_in_org, project)
     assert not rules.has_perm(perm_name, group_member_out, project)
     assert not rules.has_perm(perm_name, moderator, project)
-    assert rules.has_perm(perm_name, group_member_in_project, project)
+    assert rules.has_perm(perm_name, group_member_in_pro, project)
     assert rules.has_perm(perm_name, initiator, project)
diff --git a/tests/offlineevents/rules/test_rules_list.py b/tests/offlineevents/rules/test_rules_list.py
--- a/tests/offlineevents/rules/test_rules_list.py
+++ b/tests/offlineevents/rules/test_rules_list.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_offlineevents.list_offlineevent'
 
@@ -18,13 +18,13 @@ def test_rule(offline_event, user_factory, group_factory,
     project = offline_event.project
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, project)
     assert not rules.has_perm(perm_name, user, project)
-    assert not rules.has_perm(perm_name, group_member_in_orga, project)
+    assert not rules.has_perm(perm_name, group_member_in_org, project)
     assert not rules.has_perm(perm_name, group_member_out, project)
     assert not rules.has_perm(perm_name, moderator, project)
-    assert rules.has_perm(perm_name, group_member_in_project, project)
+    assert rules.has_perm(perm_name, group_member_in_pro, project)
     assert rules.has_perm(perm_name, initiator, project)
diff --git a/tests/offlineevents/rules/test_rules_view.py b/tests/offlineevents/rules/test_rules_view.py
--- a/tests/offlineevents/rules/test_rules_view.py
+++ b/tests/offlineevents/rules/test_rules_view.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_offlineevents.view_offlineevent'
 
@@ -18,16 +18,16 @@ def test_rule(offline_event, user_factory, group_factory,
     project = offline_event.project
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert rules.has_perm(perm_name, anonymous, offline_event)
     assert rules.has_perm(perm_name, user, offline_event)
     assert rules.has_perm(perm_name, moderator, offline_event)
     assert rules.has_perm(perm_name, initiator, offline_event)
-    assert rules.has_perm(perm_name, group_member_in_orga, offline_event)
+    assert rules.has_perm(perm_name, group_member_in_org, offline_event)
     assert rules.has_perm(perm_name, group_member_out, offline_event)
-    assert rules.has_perm(perm_name, group_member_in_project, offline_event)
+    assert rules.has_perm(perm_name, group_member_in_pro, offline_event)
 
 
 @pytest.mark.django_db
@@ -38,15 +38,15 @@ def test_rule_project_draft(offline_event_factory, user_factory, group_factory,
     project = offline_event.project
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     assert not rules.has_perm(perm_name, anonymous, offline_event)
     assert not rules.has_perm(perm_name, user, offline_event)
-    assert not rules.has_perm(perm_name, group_member_in_orga, offline_event)
+    assert not rules.has_perm(perm_name, group_member_in_org, offline_event)
     assert not rules.has_perm(perm_name, group_member_out, offline_event)
-    assert rules.has_perm(perm_name, group_member_in_project, offline_event)
+    assert rules.has_perm(perm_name, group_member_in_pro, offline_event)
     assert rules.has_perm(perm_name, moderator, offline_event)
     assert rules.has_perm(perm_name, initiator, offline_event)
 
@@ -59,14 +59,14 @@ def test_rule_project_archived(offline_event_factory, user_factory,
     project = offline_event.project
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     assert rules.has_perm(perm_name, anonymous, offline_event)
     assert rules.has_perm(perm_name, user, offline_event)
-    assert rules.has_perm(perm_name, group_member_in_orga, offline_event)
+    assert rules.has_perm(perm_name, group_member_in_org, offline_event)
     assert rules.has_perm(perm_name, group_member_out, offline_event)
-    assert rules.has_perm(perm_name, group_member_in_project, offline_event)
+    assert rules.has_perm(perm_name, group_member_in_pro, offline_event)
     assert rules.has_perm(perm_name, moderator, offline_event)
     assert rules.has_perm(perm_name, initiator, offline_event)
diff --git a/tests/plans/rules/test_rules_add.py b/tests/plans/rules/test_rules_add.py
--- a/tests/plans/rules/test_rules_add.py
+++ b/tests/plans/rules/test_rules_add.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_plans.add_plan'
 
@@ -18,14 +18,14 @@ def test_rule(plan, user_factory, group_factory,
     plan.projects.add(project)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, plan.organisation)
     assert not rules.has_perm(perm_name, user, plan.organisation)
     assert not rules.has_perm(perm_name, moderator, plan.organisation)
     assert not rules.has_perm(perm_name, group_member_out, plan.organisation)
-    assert not rules.has_perm(perm_name, group_member_in_project,
+    assert not rules.has_perm(perm_name, group_member_in_pro,
                               plan.organisation)
-    assert rules.has_perm(perm_name, group_member_in_orga, plan.organisation)
+    assert rules.has_perm(perm_name, group_member_in_org, plan.organisation)
     assert rules.has_perm(perm_name, initiator, plan.organisation)
diff --git a/tests/plans/rules/test_rules_change.py b/tests/plans/rules/test_rules_change.py
--- a/tests/plans/rules/test_rules_change.py
+++ b/tests/plans/rules/test_rules_change.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_plans.change_plan'
 
@@ -18,13 +18,13 @@ def test_rule(plan, user_factory, group_factory,
     plan.projects.add(project)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, plan)
     assert not rules.has_perm(perm_name, user, plan)
     assert not rules.has_perm(perm_name, moderator, plan)
-    assert not rules.has_perm(perm_name, group_member_in_orga, plan)
+    assert not rules.has_perm(perm_name, group_member_in_org, plan)
     assert not rules.has_perm(perm_name, group_member_out, plan)
-    assert not rules.has_perm(perm_name, group_member_in_project, plan)
+    assert not rules.has_perm(perm_name, group_member_in_pro, plan)
     assert rules.has_perm(perm_name, initiator, plan)
diff --git a/tests/plans/rules/test_rules_export.py b/tests/plans/rules/test_rules_export.py
--- a/tests/plans/rules/test_rules_export.py
+++ b/tests/plans/rules/test_rules_export.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_plans.export_plan'
 
@@ -18,14 +18,14 @@ def test_rule(plan, user_factory, group_factory,
     plan.projects.add(project)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, plan.organisation)
     assert not rules.has_perm(perm_name, user, plan.organisation)
     assert not rules.has_perm(perm_name, moderator, plan.organisation)
     assert not rules.has_perm(perm_name, group_member_out, plan.organisation)
-    assert not rules.has_perm(perm_name, group_member_in_project,
+    assert not rules.has_perm(perm_name, group_member_in_pro,
                               plan.organisation)
-    assert rules.has_perm(perm_name, group_member_in_orga, plan.organisation)
+    assert rules.has_perm(perm_name, group_member_in_org, plan.organisation)
     assert rules.has_perm(perm_name, initiator, plan.organisation)
diff --git a/tests/plans/rules/test_rules_list.py b/tests/plans/rules/test_rules_list.py
--- a/tests/plans/rules/test_rules_list.py
+++ b/tests/plans/rules/test_rules_list.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_plans.list_plan'
 
@@ -18,13 +18,13 @@ def test_rule(plan, user_factory, group_factory,
     plan.projects.add(project)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert rules.has_perm(perm_name, anonymous, None)
     assert rules.has_perm(perm_name, user, None)
     assert rules.has_perm(perm_name, moderator, None)
     assert rules.has_perm(perm_name, initiator, None)
-    assert rules.has_perm(perm_name, group_member_in_orga, None)
+    assert rules.has_perm(perm_name, group_member_in_org, None)
     assert rules.has_perm(perm_name, group_member_out, None)
-    assert rules.has_perm(perm_name, group_member_in_project, None)
+    assert rules.has_perm(perm_name, group_member_in_pro, None)
diff --git a/tests/plans/rules/test_rules_view.py b/tests/plans/rules/test_rules_view.py
--- a/tests/plans/rules/test_rules_view.py
+++ b/tests/plans/rules/test_rules_view.py
@@ -2,7 +2,7 @@
 import rules
 
 from adhocracy4.test.helpers import setup_users
-from tests.helpers import setup_group_users
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_plans.view_plan'
 
@@ -18,16 +18,16 @@ def test_rule(plan, user_factory, group_factory,
     plan.projects.add(project)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert rules.has_perm(perm_name, anonymous, plan)
     assert rules.has_perm(perm_name, user, plan)
     assert rules.has_perm(perm_name, moderator, plan)
     assert rules.has_perm(perm_name, initiator, plan)
-    assert rules.has_perm(perm_name, group_member_in_orga, plan)
+    assert rules.has_perm(perm_name, group_member_in_org, plan)
     assert rules.has_perm(perm_name, group_member_out, plan)
-    assert rules.has_perm(perm_name, group_member_in_project, plan)
+    assert rules.has_perm(perm_name, group_member_in_pro, plan)
 
 
 @pytest.mark.django_db
@@ -38,13 +38,13 @@ def test_rule_plan_draft(plan_factory, user_factory, group_factory,
     plan.projects.add(project)
 
     anonymous, moderator, initiator = setup_users(project)
-    group_member_in_orga, group_member_out, group_member_in_project, project \
-        = setup_group_users(user_factory, group_factory, project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert not rules.has_perm(perm_name, anonymous, plan)
     assert not rules.has_perm(perm_name, user, plan)
     assert not rules.has_perm(perm_name, moderator, plan)
-    assert not rules.has_perm(perm_name, group_member_in_orga, plan)
+    assert not rules.has_perm(perm_name, group_member_in_org, plan)
     assert not rules.has_perm(perm_name, group_member_out, plan)
-    assert not rules.has_perm(perm_name, group_member_in_project, plan)
+    assert not rules.has_perm(perm_name, group_member_in_pro, plan)
     assert rules.has_perm(perm_name, initiator, plan)
diff --git a/tests/projectcontainers/dashboard_components/test_views_container_basic.py b/tests/projectcontainers/dashboard_components/test_views_container_basic.py
--- a/tests/projectcontainers/dashboard_components/test_views_container_basic.py
+++ b/tests/projectcontainers/dashboard_components/test_views_container_basic.py
@@ -3,7 +3,7 @@
 from adhocracy4.dashboard import components
 from meinberlin.test.helpers import assert_dashboard_form_component_edited
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('container-basic')
 
@@ -34,10 +34,10 @@ def test_edit_view(client, project, project_container_factory):
 def test_edit_view_group_member(client, project, project_container_factory,
                                 group_factory, user_factory):
     project_container = project_container_factory(projects=[project])
-    group_member, _, project_container = setup_group_member(
-        None, project_container, group_factory, user_factory)
+    project_container, _, group_member_in_pro, _ = \
+        setup_group_members(project_container, group_factory, user_factory)
     url = component.get_base_url(project_container)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/projectcontainers/dashboard_components/test_views_container_information.py b/tests/projectcontainers/dashboard_components/test_views_container_information.py
--- a/tests/projectcontainers/dashboard_components/test_views_container_information.py
+++ b/tests/projectcontainers/dashboard_components/test_views_container_information.py
@@ -3,7 +3,7 @@
 from adhocracy4.dashboard import components
 from meinberlin.test.helpers import assert_dashboard_form_component_edited
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('container-information')
 
@@ -31,10 +31,10 @@ def test_edit_view(client, project, project_container_factory):
 def test_edit_view_group_member(client, project, project_container_factory,
                                 group_factory, user_factory):
     project_container = project_container_factory(projects=[project])
-    group_member, _, project_container = setup_group_member(
-        None, project_container, group_factory, user_factory)
+    project_container, _, group_member_in_pro, _ = \
+        setup_group_members(project_container, group_factory, user_factory)
     url = component.get_base_url(project_container)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/projectcontainers/dashboard_components/test_views_container_plans.py b/tests/projectcontainers/dashboard_components/test_views_container_plans.py
--- a/tests/projectcontainers/dashboard_components/test_views_container_plans.py
+++ b/tests/projectcontainers/dashboard_components/test_views_container_plans.py
@@ -3,7 +3,7 @@
 from adhocracy4.dashboard import components
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('plans')
 
@@ -32,11 +32,12 @@ def test_edit_view(client, plan_factory, project_container):
 @pytest.mark.django_db
 def test_edit_view_group_member(client, plan_factory, project_container,
                                 group_factory, user_factory):
-    group_member, organisation, project_container = setup_group_member(
-        None, project_container, group_factory, user_factory)
+    project_container, _, group_member_in_pro, _ = \
+        setup_group_members(project_container, group_factory, user_factory)
+    organisation = project_container.organisation
     plan = plan_factory(organisation=organisation)
     url = component.get_base_url(project_container)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/projectcontainers/dashboard_components/test_views_container_point.py b/tests/projectcontainers/dashboard_components/test_views_container_point.py
--- a/tests/projectcontainers/dashboard_components/test_views_container_point.py
+++ b/tests/projectcontainers/dashboard_components/test_views_container_point.py
@@ -4,7 +4,7 @@
 
 from adhocracy4.dashboard import components
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('point')
 
@@ -41,10 +41,10 @@ def test_edit_view(client, project_container, administrative_district):
 def test_edit_view_group_member(
         client, project_container, administrative_district,
         group_factory, user_factory):
-    group_member, _, project_container = setup_group_member(
-        None, project_container, group_factory, user_factory)
+    project_container, _, group_member_in_pro, _ = \
+        setup_group_members(project_container, group_factory, user_factory)
     url = component.get_base_url(project_container)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/projectcontainers/dashboard_components/test_views_container_topics.py b/tests/projectcontainers/dashboard_components/test_views_container_topics.py
--- a/tests/projectcontainers/dashboard_components/test_views_container_topics.py
+++ b/tests/projectcontainers/dashboard_components/test_views_container_topics.py
@@ -4,7 +4,7 @@
 from adhocracy4.dashboard import components
 from adhocracy4.test.helpers import redirect_target
 from meinberlin.test.helpers import assert_dashboard_form_component_response
-from meinberlin.test.helpers import setup_group_member
+from meinberlin.test.helpers import setup_group_members
 
 component = components.projects.get('topics')
 
@@ -33,10 +33,10 @@ def test_edit_view(client, project_container):
 @pytest.mark.django_db
 def test_edit_view_group_member(client, project_container,
                                 group_factory, user_factory):
-    group_member, _, project_container = setup_group_member(
-        None, project_container, group_factory, user_factory)
+    project_container, _, group_member_in_pro, _ = \
+        setup_group_members(project_container, group_factory, user_factory)
     url = component.get_base_url(project_container)
-    client.login(username=group_member.email, password='password')
+    client.login(username=group_member_in_pro.email, password='password')
     response = client.get(url)
     assert_dashboard_form_component_response(response, component)
 
diff --git a/tests/projects/rules/test_rules_participate.py b/tests/projects/rules/test_rules_participate.py
--- a/tests/projects/rules/test_rules_participate.py
+++ b/tests/projects/rules/test_rules_participate.py
@@ -40,8 +40,8 @@ def test_participate_project_draft(user_factory, group_factory, organisation,
     assert not rules.has_perm(perm_name_participate, group_member_in_orga,
                               project)
     assert not rules.has_perm(perm_name_participate, group_member_out, project)
-    assert not rules.has_perm(perm_name_participate, group_member_in_project,
-                              project)
+    assert rules.has_perm(perm_name_participate, group_member_in_project,
+                          project)
     assert rules.has_perm(perm_name_participate, moderator, project)
     assert rules.has_perm(perm_name_participate, initiator, project)
     assert rules.has_perm(perm_name_participate, admin, project)
@@ -150,8 +150,8 @@ def test_participate_private_project(user_factory, group_factory,
     assert not rules.has_perm(perm_name_participate, group_member_in_orga,
                               project)
     assert not rules.has_perm(perm_name_participate, group_member_out, project)
-    assert not rules.has_perm(perm_name_participate, group_member_in_project,
-                              project)
+    assert rules.has_perm(perm_name_participate, group_member_in_project,
+                          project)
     assert rules.has_perm(perm_name_participate, participant, project)
     assert rules.has_perm(perm_name_participate, moderator, project)
     assert rules.has_perm(perm_name_participate, initiator, project)
@@ -190,8 +190,8 @@ def test_participate_semiprivate_project(user_factory, group_factory,
     assert not rules.has_perm(perm_name_participate, group_member_in_orga,
                               project)
     assert not rules.has_perm(perm_name_participate, group_member_out, project)
-    assert not rules.has_perm(perm_name_participate, group_member_in_project,
-                              project)
+    assert rules.has_perm(perm_name_participate, group_member_in_project,
+                          project)
     assert rules.has_perm(perm_name_participate, participant, project)
     assert rules.has_perm(perm_name_participate, moderator, project)
     assert rules.has_perm(perm_name_participate, initiator, project)
diff --git a/tests/topicprio/rules/test_rules_add.py b/tests/topicprio/rules/test_rules_add.py
--- a/tests/topicprio/rules/test_rules_add.py
+++ b/tests/topicprio/rules/test_rules_add.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.topicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_topicprio.add_topic'
 
@@ -17,96 +18,138 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, user):
+def test_pre_phase(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, user):
+def test_phase_active(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, user, user2):
+def test_phase_active_project_private(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, participant, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(
         phase_factory, None, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, participant, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase,
                                             module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, user, admin, user_factory, group_factory):
     phase, module, project, _ = setup_phase(phase_factory, None,
                                             phases.PrioritizePhase,
                                             module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, module)
         assert not rules.has_perm(perm_name, user, module)
+        assert not rules.has_perm(perm_name, group_member_out, module)
+        assert not rules.has_perm(perm_name, group_member_in_org, module)
+        assert rules.has_perm(perm_name, group_member_in_pro, module)
         assert not rules.has_perm(perm_name, moderator, module)
         assert rules.has_perm(perm_name, initiator, module)
+        assert rules.has_perm(perm_name, admin, module)
diff --git a/tests/topicprio/rules/test_rules_change.py b/tests/topicprio/rules/test_rules_change.py
--- a/tests/topicprio/rules/test_rules_change.py
+++ b/tests/topicprio/rules/test_rules_change.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.topicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_topicprio.change_topic'
 
@@ -17,47 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, topic_factory, user):
+def test_pre_phase(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, topic_factory, user):
+def test_phase_active(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, topic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -66,20 +86,28 @@ def test_phase_active_project_private(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, topic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -88,39 +116,60 @@ def test_phase_active_project_semipublic(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
         assert not rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, topic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, topic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
     creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert not rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/topicprio/rules/test_rules_comment.py b/tests/topicprio/rules/test_rules_comment.py
--- a/tests/topicprio/rules/test_rules_comment.py
+++ b/tests/topicprio/rules/test_rules_comment.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.topicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_topicprio.comment_topic'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, topic_factory, user):
+def test_pre_phase(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, topic_factory, user):
+def test_phase_active(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, topic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, topic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, topic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, topic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/topicprio/rules/test_rules_rate.py b/tests/topicprio/rules/test_rules_rate.py
--- a/tests/topicprio/rules/test_rules_rate.py
+++ b/tests/topicprio/rules/test_rules_rate.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.topicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_topicprio.rate_topic'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, topic_factory, user):
+def test_pre_phase(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_pre_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, topic_factory, user):
+def test_phase_active(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_public
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, topic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, topic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
-    participant = user2
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, topic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, topic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
diff --git a/tests/topicprio/rules/test_rules_view.py b/tests/topicprio/rules/test_rules_view.py
--- a/tests/topicprio/rules/test_rules_view.py
+++ b/tests/topicprio/rules/test_rules_view.py
@@ -8,6 +8,7 @@
 from adhocracy4.test.helpers import setup_phase
 from adhocracy4.test.helpers import setup_users
 from meinberlin.apps.topicprio import phases
+from meinberlin.test.helpers import setup_group_members
 
 perm_name = 'meinberlin_topicprio.view_topic'
 
@@ -17,42 +18,66 @@ def test_perm_exists():
 
 
 @pytest.mark.django_db
-def test_pre_phase(phase_factory, topic_factory, user):
+def test_pre_phase(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_pre_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active(phase_factory, topic_factory, user):
+def test_phase_active(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.access == Access.PUBLIC
     with freeze_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_private(phase_factory, topic_factory,
-                                      user, user2):
+def test_phase_active_project_private(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.PRIVATE
     )
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.PRIVATE
@@ -60,19 +85,28 @@ def test_phase_active_project_private(phase_factory, topic_factory,
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_semipublic(phase_factory, topic_factory,
-                                         user, user2):
+def test_phase_active_project_semipublic(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(
         phase_factory, topic_factory, phases.PrioritizePhase,
         module__project__access=Access.SEMIPUBLIC
     )
     anonymous, moderator, initiator = setup_users(project)
-    participant = user2
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
+    participant = user_factory()
     project.participants.add(participant)
 
     assert project.access == Access.SEMIPUBLIC
@@ -80,35 +114,60 @@ def test_phase_active_project_semipublic(phase_factory, topic_factory,
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
         assert rules.has_perm(perm_name, participant, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_phase_active_project_draft(phase_factory, topic_factory, user):
+def test_phase_active_project_draft(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_draft=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_draft
     with freeze_phase(phase):
         assert not rules.has_perm(perm_name, anonymous, item)
         assert not rules.has_perm(perm_name, user, item)
+        assert not rules.has_perm(perm_name, creator, item)
+        assert not rules.has_perm(perm_name, group_member_out, item)
+        assert not rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)
 
 
 @pytest.mark.django_db
-def test_post_phase_project_archived(phase_factory, topic_factory, user):
+def test_post_phase_project_archived(
+        phase_factory, topic_factory, user, admin, user_factory,
+        group_factory):
     phase, _, project, item = setup_phase(phase_factory, topic_factory,
                                           phases.PrioritizePhase,
                                           module__project__is_archived=True)
     anonymous, moderator, initiator = setup_users(project)
+    creator = item.creator
+    project, group_member_in_org, group_member_in_pro, group_member_out = \
+        setup_group_members(project, group_factory, user_factory)
 
     assert project.is_archived
     with freeze_post_phase(phase):
         assert rules.has_perm(perm_name, anonymous, item)
         assert rules.has_perm(perm_name, user, item)
+        assert rules.has_perm(perm_name, creator, item)
+        assert rules.has_perm(perm_name, group_member_out, item)
+        assert rules.has_perm(perm_name, group_member_in_org, item)
+        assert rules.has_perm(perm_name, group_member_in_pro, item)
         assert rules.has_perm(perm_name, moderator, item)
         assert rules.has_perm(perm_name, initiator, item)
+        assert rules.has_perm(perm_name, admin, item)