Not sure I fully understand the issue, but here goes...

If the issue is around understanding and controlling who does what role on the project (e.g. projct resource), then use Project Groups as opposed to Global Groups.

This would allow each project administrator to define group membership for their own project (e.g.  define who is a "developer", "tester", etc.).  Global admins just need to assign Project Groups the relevant permissions -- project admins define group membership.

Not suire if this answers your concern.