due to security reasons we do not want to give project managers the ability to delete tasks or even projects (do not loose information by accident). Only admins should be allowed to delete things. Due to this we intrduced a new access rights level "project manager" which has the same rights as Full except the ability to delete things.
Now we recognized that if you put somebody as assignee to a project this project he is automatically set to Full rights. Even though the person who assigns the project to him does not have Full rights. This means anybody can annull access rights easily.
Does anybody knwo a setting or way to prevent this? I would like to have something that only admin groupd is full right, all others who are set to Full are automatically downdgraded to project manager.
In automation I could not find anything helping with access rights.