Customers want per-project roles rather than one global role. How do you model that, and where in the request does the check happen?

Short answer

Model permission as a relationship between a subject, a role and a specific resource, not as a role stamped on the user, and push the check down into the data access predicate so a list query and a single-record fetch are authorised by the same rule.

This is authorisation modelling, and RBAC is only one possible shape. Good authorisation starts with the domain action, then decides whether RBAC roles, relationship-based checks, policy rules, or resource ownership should decide access. Weak RBAC designs put every exception into a new role until nobody knows what a role means. Strong authorisation keeps RBAC readable and puts the final check close to the resource being protected.