How can I ensure that a user can access and manage only the awards and projects of a particular organization, not those of the entire business unit?

You can assign the Grants Department Administrator role so that the user can manage only those awards and projects that belong to a particular organization in a business unit, instead of all the organizations of the business unit.

If the project organization isn't the same as the award organization, you can assign the user to the project organization using the Project Administrator role and Project Organization Classification context on the Manage Data Access page in the Setup and Maintenance work area.

To grant data access to the Grants Department Administrator role, assign the user to the Award Organization Hierarchy context available to the role and provide the organization hierarchy, version, and starting organization. The starting organization can be any node in the organization hierarchy. If you select a higher level organization, then the user can access awards that belong to the starting organization and any of the organizations beneath the starting organizations.

Only organization hierarchies, which are assigned to the project business unit on the Define Project Business Unit Implementations page, are available as organization hierarchies on the Manage Data Access page for Grants department administrators and the Award Organization Hierarchy context. Only the award templates and project templates belonging to the organizations in the award organization hierarchy are available to a user with the Grants Department Administrator role to create awards or projects.