We have provided Read-only access to WorkflowTemplate table for a custom usergroup we have created. When we logged in as a user part of this group and checked for access rights we could see the permissions are working fine in List view and editor area sections as shown in the first screen shot(first.png). But the users is able to create a new workflow by clicking on the "Create workflow action" icon present in the list-view header as shown in the second screen shot(second.png). The access rights we gave is not impacted in this are and we are not sure how to fix this.
Any suggestions on how to fix this issue would be truly appreciated.