how tie a user to a single project

[Deleted user]

Is there a way to tie individual users to specific projects, such that they have no access to any other projects, while at the same time allowing other users full cross-project access?

Imagine 3 projects, A, B & C and 3 users, 1, 2 & 3.

User 1 must only have access to Project A.
User 2 must only have access to Project B.
User 3 must have access to all 3 Projects.

I've spent some time working with user groups, project roles & permission schemes, but nothing seems to quite give the required result. 

My approach was:

• define 2 user groups: 'limited' & 'unlimited'.
• assign Users 1 & 2 to the 'limited' group & User 3 to 'unlimited'
• explicitly add User 1 to Project A
• explicitly add User 2 to Project B
• define a permission scheme allowing project browsing to group 'unlimited' only.
• link Project C with this scheme. 
• define another permission scheme allowing project browsing to both groups.
• link Projects A & B with this scheme.  

My expectation was User 1 would have access to Project A only and User 2 would have access to Project B only, as they were assigned to those projects explicitly, but not to Project as they are not assigned to it not and not in a group which can browse to it.  

This was not the case. It seemed that assigning a user to a project does nothing. Both User 1 & User2 could see both Projects A & B, though not Project C.

I'd really appreciate some advice!

thx

Paul

[Deleted user · Accepted solution]

OK... yet more head-scratching & I think I've cracked it...Posting this in case anyone else needs this feature (eg to grant an external contractor access to a specific project only).

I wasn't too far off...

the solution was:

• define 2 user groups: 'limited' & 'unlimited'.
• assign Users 1 & 2 to the 'limited' group & User 3 to 'unlimited'
• define a new Project Role: 'limited access'
• explicitly add User 1 to Project A with the role 'limited access'  
• explicitly add User 2 to Project B with the role 'limited access'
• define a permission scheme allowing project browsing to user group 'unlimited' only.
• link Project C with this scheme. 
• define another permission scheme allowing project browsing to user group 'unlimited' & project role 'limited access'.
• link Projects A & B with this 2nd scheme.

User 1 will have visibility of Project A only, because:

• They have been assigned to that project only and with the 'limited access' project role.
• They can't see Project B as they haven't been assigned to it with that role.
• They can't see Project C as it explicitly blocks visibility from users not in the user group 'unlimited'.

The same applies to User 2 & Project B

User 3 can access all 3 projects as they are in user group unlimited, which has browse permission across all projects.