Comment 1 for bug 1649532

This traces back to the famous bug 968696... a user with the admin role on ANY project is allowed to do many things requiring the admin role in other projects where they do not have the admin role. It's awful, but for now you'll just have to be very careful to whom you give the admin role.

I think we're finally making some progress on fixing it, but it will be a while yet. As in, Rocky at the earliest, and that is probably being overly optimistic.