This is currently intended, although I think it's not out of the question that we might relax it or otherwise take another look at it.

Right now, subprojects still litter the global space in a lot of ways (they're top-level in typeaheads, for example, and top-level in the Projects list, currently), and it was hard for me to imagine that users could be trusted to create subprojects but not create top-level projects. Are there specific reasons that you don't trust particular users to create projects, but do trust them to create subprojects?

If you're mostly concerned about project litter, are you thinking about UIs other than typeaheads/the main list?

A possibly finer-grained version of this is milestones -- these create somewhat less litter, but not hugely less.

Part of the pathway forward here may also be to reduce the prominence of subprojects in typeaheads/lists, or reduce it conditionally or something.

We tossed around some list design ideas internally (e.g., replace the list with hovercard-like cards?) and M10 is a much older mock with a card-based layout. We haven't found anything that feels good yet, but I suspect we'll refine the list somehow, sooner or later, since it's the one part of projects that didn't really get touched in this most recent iteration. The UI will probably be riper for rework after installs have more time to upgrade, experiment with subprojects, and start encountering problems or limitations with the existing list.

If we did adjust the UIs in a way that tended to reduce the prominence of subprojects, I'd be more inclined to look at refining the permissions, but it mostly feels to me like subprojects and top-level projects aren't very different from a permission standpoint right now.

We also have an interest in this. For us it isn't about 'trust' but about social expectations and affordances. We want users to talk to us before making a global project, but to be able to divide their own team as they wish.

If the motivation is primarily social, you might be able to use a social permission:

• Create a Legalpad document (say, L1), with content like this:

• I promise I will only use this power for good.
• I will ask before creating any new global projects.
• If I abuse this power, I solemnly swear and affirm I will buy the dev tools team a puppy / nice bottle of scotch / 3D printer to make amends.

• Set "Can Create Projects" policy to: Custom Policy > [Allow] [Signers of legalpad documents] [L1].

That would actually work for us.