Take a look at the permissions for your specific domain (context). It very likely that you are inheriting permissions from the site level and organization level. If you are using out of the box roles then you very well may have permissions affecting that role that are propagating down from a higher level domain. If you've created a new role, you will still inherit any permissions that apply to "All" principals. You're will probably need to remove some of these broad permissions at the upper levels and then re-grant them to the appropriate roles as necessary.
↧