We're using MoodleRooms platform (moodle 3.1) with Snap Theme hosted by BlackBoard. We have the Attendance community plugin available, it it seems that although the role definitions on site level are ok and the students shouldn't be able to manage attendances or change fellow students' attendances on a session in an attendance activity on a course, they are allowed to do so. I the site level role definition we've allowed students to record their own attendances (choosing the suitable variable defined by the teacher).

In the screenshot https://postimg.org/image/pohx13p2b/ I am logged in as the first student in the list, and I am able to change the attendances of all the students.

The BB support staff considered this a bug, and suggested it should be solved by Moodle developers.