Program Manager Access to Issues / Risks / Scope Changes
We have found that when a Program Manager adds a project to their program, they are granted full edit capabilities to any / all associated project Issues, Risks and Scope Changes. What we are trying to determine is if this is expected PPM behavior, as we would prefer only view privileges. We have proven this by changing "User Access" settings to only allow "Edit" to the "Created By" resource (who is not the Program Manager) on the Project Issue, Project Risk, and Project Scope Change Request Types. Even with this setting, Program Managers can edit everything.
Re: Program Manager Access to Issues / Risks / Scope Changes
in my view this is per design.
The Program Management User Guide gives ample explanations on why Project Risks, Issues and Scope changes and even the processes that are used are important to Program Managers and that even the processes are editable in the context. There must be some additional (possibly non-editable) access grants on the Program Manager role that allows for this. Please check the mentioned guide (I'll attach it for your reference) to make yourself familiar with the functionality that is out of the box.
When still in doubt, please raise a ticket to have this further investigated, if necessary with RnD to check the intended design.