Define authorized scope of projects for users

Not suer if this should be included. Why did you do this way?