I thought I had it perfectly right in my head when I went to try this out.
What I'm trying to do: one permission scheme to cover them all
Permission scheme Client Support PS - Browse Project permission > Project Role [Users]
Project 1, Project 2 use Client Support PS
Project 1 assigns Client 1 Group to User Role
Project 2 assigns Client 2 Group to User Role
I expect User 1 in Client 1 Group would only be able to browse Project 1, but instead, they can see Project 2 as well.
I don't understand what's happening here. Could someone explain this? I do not want to be forced to create a scheme for every client.