I have a requirement for group of operators to only have read capability for all instances of two case types within an application for auditing purposes. I tried cloning the User4 role and then applying access deny rules on writing for the case type classes, but nothing changed i.e. still able to create new cases,etc. I would greatly appreciate anyone's help with this.