Associating Incidents across Projects

Part of the reason for separate projects is so we can outsource development and/or testing to contractors.  Yes, we have contractual protections in place, like Non-Disclosure Agreements, but it is still best if the contractors simply don't have access to everything.  Currently, the only effective way to prevent contractors from having access to too much is to isolate them in their own project.  It would be best if security roles CRUD permissions could be assigned at something a little more granular than the artifact type.  For example, only allow a role read access for specific requirements and everything below them in the hierarchy of requirements.  Of course this would get very complicated very fast, but I don't think it's worse than trying to maintain and sync copies of artifact data across separate projects.