We really need a permission set to prevent some users from mass updating projects.