We have several staff members who are assigned full time to specific clients. In some cases they're not even staff, but rather contractors. In that case, they must only be able to see and respond to tickets involving their assigned clients.
Perhaps when creating/editing roles, there can be the option to select one or more clients. Then that role can only view/edit data if it relates to those selected clients and for the tasks selected in the roles permissions. Then I would create a role called "Client X Assigned Staff" for example.
Then perhaps as a side feature it would make sense to allow multiple roles per administrator.
I know this has been requested in the past, but those feature requests were quite vague and/or hard to understand.