At the moment Jenkins allows per-project permissions to be set for the "Build Now" functionality.

With a gerrit-trigger based workflow the permission to allow forcibly triggering a project is set at a global level but not at a project level meaning that users with the permission can trigger projects that do not belong to them. This should be fixed.