In an out of the box Sugar instance, I have a user with a role that prohibits him from editing any Accounts, Contacts or Cases.
The relationship between Accounts and Cases is one-to-many, and relationship between Cases and Contacts is many-to-many. This is all out of the box.
1) If I access a an Account with that user, it doesn't let me link existing cases to it. (correct)
2) If I access a Case with that user, it allows me to link it with existing Contacts. (incorrect)
Does anyone have a solution or workaround for this?