restrict reading tickets to correct project scope
restrict creating tickets only to users who have permission to do it