Debuging OG access field
Unfortunately I have to surrender. There is a bug somewhere in the og module but I can not track it down. What happens is that the default group membership role can not be changed. Changing the definition of OG_AUTHENTICATED_ROLE in the og.module does nothing. Because of that all the access rights given to the "member" role are being inherited by all the other roles and so they can not be weaker.

My solution will have to be creation of new members role - "full_member" where I will be able to define roles of that member. I will also remove all permissions from the "member" role. The problem is that I will have to redo all the rules, contexts, pages, blocks, custom code and so on. Few days of boring work and debugging.