Workaround A: Use System Administrator
If you need to manage the permissions (adding/removing users from Roles etc.), you can log into the SDL Trados GroupShare WebUI with a user which is on the Root Organization and is assigned the Administrator role.This allows to handle the permissions since that user has permissions to access all sites on the GroupShare WebUI.
Workaround B: Dynamic Resource Access
When creating projects or working with projects, during the project creation you can assign users for each step of the chain i.e. for Reviewing documents. If that stage of the translation project has come and the document is assigned, the user will get the relevant permissions to access the document/Translation Memory etc. for reviewing the document without the need to assign via the GroupShare WebUI the permission manually for reviewing documents within the organization the project is in.
Workaround C: Do not assign Roles to user within an Organization he doesn't belong to...
When creating a user i.e. in Organization A with any Role assigned, do not provide/add that same user to another Role within another Organization.