Authorization object B_BUPA_FDG

Hi,

We are working on tightening our authorizations on business partners.

We have introduced the B_BUPA_FDG, so on field group.

Also field groups have been added to customizing (define field group for authorizations).

In authorization trace we see that user is NOT authorized for field group, but still in this case the address can be changed.
User has display authorization for field group, but not change authorization.

Are we overlooking something?

Regards,

Walter van Veen