Expected, and thanks for testing before the auditor did. Groups only add permissions on top of the role. The group itself grants nothing that writes, but the User role holds some rights that act, by default. The ones you ran into: acknowledging alarms, running rules and switching their mode, and sending basic (read-only) commands.
Two ways to close it:
- If no User in your organisation should do those things, untick
iot_alarm.acknowledge,iot_rules.run,iot_rules.modeandiot_rpc.send.basicfor User in Access Rights. - If it’s only the viewers, write a Deny access policy with those actions and the condition
subject.roles containsthe viewer group’s key. Deny always wins. Run it in shadow mode first and check it in the access tester with an owner’s role so you don’t lock yourself out.