In our EDR change task workflow, there is a setup participants task where someone picks a review team and that team is properly restricted to those who can see the context. But sometimes our users go to the Members list and add users directly to the review team role. Adding on the Members is not restricted in the same way as the workflow and they could add someone they should not have been able to choose (the unsecure person could not see any details of the EDR or its objects, but they did get the task and could blindly approve it).
Can the Members area be view-only? Is there a permission to restrict it? I setup a read-only user such that they can't edit a certain document but can still modify the Members list.
