return empty array if accesing Project's team members prohibited by authorization rules