Section 8.3.2: Make projects only visible to users with permission to see them
Section 8.3.5: Don’t show projects that a user doesn't have permission to see
Section 8.4: Restrict reading tickets to correct project scope
Section 8.5.3: Restrict creating tickets to only users who have permissions to do it
Section 8.6.2: Restrict ticket updating to only those who have write permission on the project
Section 8.7: Restrict destroy action to only people with permission