How are non-financial projects secured and associated to Organization?

Summary:

Is a non-financial project associated to any organization object? If not, what controls security?

Content (please ensure you mask any confidential information):

Until now, we have only used Financial projects in our operations, i.e. associated to expenditure org, task owning org, etc, BU, etc. It works fine.

We are exploring increased use of non-financial projects and tasks within Project Management to support the Procurement process. More or less as described in the Sourcing user guide, using the standard sourcing integration. It works, but so far we have not been able to figure out how a non-financial project is associated to the org structure. And how security would work. So need your help on this.