User can make changes in Service Master Record without Authorization

Hi Gurus,

We are facing an issue where user can make changes in the services master record even if he is not authorized to do the same -

Please check and do let me know the standard SAP behavior!

Process -

1. I create a new role in which Authorization object "M_SRV_LS" we maintain ACTVT - 03, that means user can only display the service master record.
2. Now user goto transaction AC3
3. Click on the "Other Services" Push button,
4. Now when he open another service master record all the fields are editable mode, so user can make changes in the service master record & there is not restriction works.

Please check and do let me know in case I just want to provide the display only activity for service master record, what is the process.

Thanks,