Default Join Policy: Restricted Project
In detail, this means that these users can take this action, provided they pass all of the checks described above first: