Hi, as you have identified, the problem is the Z:_MM_Processing role so that is the one which you should be amending. In this case restricting the STATM values to the ones required. From the look of the title of the role it's likely designed to give access to all material status so a more restricted variant is needed if that is a key control requirement for you.
Cheers