[Erp5-users] A question about security

[Sebastian Bijak]

Hi

What i understood so far is that i must set two levels of security. First one
for example at portal type Person Module i must map roles for users so they can
see it at erp site. At this level i must also set a permission to add new
persons so the user could use Add Person action. Second level of security
defines accessability to Person information. At this level i set permission to
edit Person and gives roles needed to use workflow. Please tell me if i'm wrong.
I have a little problem with security when i map a role for a person, for
example when i give some user an Auditor role the permissions look like already
defined. It doesn't matter that, at security tab for chosen portal type,
permissions for Auditor are not selected. The user that has Auditor role can see
module and access it as the Assignor can add new contents and edit them. How can
i clear this settings to give permissions as i want?

regards
Sebastian