How to set privacy?

In Basecamp 3, you must be invited to a given Project to even see it and its contents. If you are invited, you can be classified as either the Client or as the Team. Those in the Client category can have restricted visibility of selected items posted by the Team. Account admins control who is in which category. It is pretty simple and handy and works well for us.

I believe the admin has to set permission for a client to be a part of the job. So that's the way to include/exclude someone. You can add people to job; if they aren't added, they do not have access to the job, as far as I know.