Properly implemented RBAC means Users in Teams have specific permissions, on specific objects. And no permissions at all on all the other objects.

E.g.: Currently Users in the role of Project Contributor, assigned in a Team, with a Project Group set to it, can still perform edits in projects out of their scope.

My intended use is for 'Business' Users to be assigned to a Team which allows them to see only their own projects, and not anything else. In these projects they should be able to promote a release to Production (or other stages).