I believe the issue arises because your member holds the role of a Developer. This role inherently allows the creation of resources within their account, such as products, devices, etc. However, if this user creates a product in their own account and then assigns it to a project under a different owner, it will not function as intended. We should address this issue by restricting such actions in the UI/API.
The user should create the product while the target project is selected. This way, the product is automatically created within the appropriate project. It’s worth noting that this protocol is currently enforced for users with the “Project Member” role, preventing them from working outside designated projects.
Consider projects as workspaces where multiple users collaborate using a shared set of resources. However, all these resources are owned by the project owner. Consequently, if a developer or project member exits the organization and their account is deleted, the overall setup remains unaffected.
With this in mind, assigning users the “Project Member” role is often sufficient. This role enables them to perform the same tasks as a developer but ensures they operate within the confines of a parent, shared project.
I hope this explanation is helpful. If you have any further questions or concerns, please feel free to reach out.