When changing role from admin or teacher down to student through a role-change popup menu, then going to a database activity, one can add and edit entries even if that is specifically forbidden through overrides in the activity. When one logs in properly as a student, this works as expected. Somehow, when the role is degraded, this specific aspect is carried over from the full role.