SurveyTester grants permissions through roles. Combine roles per user, use empty roles as groups for client projects, and never strip the admin role.