I made an attempt at using this in a separate branch, and it turns out that it's by no means a silver bullet.

For now, I have continued with the explicit filtering approach.

I think at this point we should think about how we want to lock the API down so that, for example, user a in team 101 can't get at the projects that team 102 has.