Our application is facing a security concern wherein admin rule forms such as access groups, data types, operator rules can be opened by end users by hitting the rule form url.

Hence this resulted in vertical privilege escalation.

The end users' access group is mapped to the role - PegaRULES:WorkMgr4. 

Can you please direct how can we deny admin access to the users.

Steps to reproduce:

1. Login using admin user id. Open access group rule. Open the rule form in new tab (using scroll of the mouse) . Copy the URL of the ruleform in the new tab.
2. Login using end user operator id in incognito. Open new tab. Paste the URL copied in step1.
3. The rule form opens, though in the current session we have logged in just using the end user operator id.