Trying to set up read only role in Drupal
So it turned out that the &quot;Contact edit&quot; capability was turned on for the &quot;Authenticated User&quot; role.  One needs to remember that Drupal &quot;ORs&quot; the permissions for logged in users in any custom role with the permissions in the &quot;Authenticated User&quot; role.
Always check the defaults before blaming the software!