Create project. Change access as needed. Create System with wizard, or without wizard. Check access on system. Find that access is not inherited to the system file.
To comply to ITAR &EAR we require a predetermined access definition or a minimum (such as creator only) access on all new data.
Project access default to US Employee Only group or owner. All systems and files to inherit that access. Access could then be changed but by deliberate adjustment only. Preferably only adjustable with specific permissions.