I am using some multi-record custom data sets and they are working well. I have been able to import records, use them in reports, use them in searches, add/edit and delete records. All seems to work fine for me except the authorization.
I have simple permissions - 1) Edit everything and 2) View Only. However, the multi-record custom data sets are open for update (add/edit/delete) for the view only users. The view only users cannot edit any other aspect of a contact yet they can do anything to a custom data set.
I have tried refining the permissions using ACLs for the custom data sets with the same result.
Is there something I can do to make the multi-record custom data sets not open for change?
We are using Drupal and CiviCRM 4.6