Bex Browser and roles

Question

Hello All,
We currently use the BEx browser to deploy the queries and workbooks to all the users.
We have set the auth object S_USER_AGR with the value '03 - Display' only.
However, what we are observing that the users are having the capability to move workbooks from their favorites to the roles.
When we run a trace for authorization check, it is checking the above auth object and shows a value being returned for 01 - Create, 02 - Change, 06 - Delete.
Object           Text                                                                               
S_USER_AGR RC=0  ACT_GROUP=NY_BW_WP_QUERY_USER;ACTVT=02;
S_USER_AGR RC=0  ACT_GROUP=NY_BW_WP_QUERY_USER;ACTVT=01;
S_USER_AGR RC=0  ACT_GROUP=NY_BW_WP_QUERY_USER;ACTVT=06;
However, in the above mentioned role, the only value assigned is 03 - Display.
The users have no other roles which would override the values.
We want to ensure that the users DO NOT have the capability to save the work books from their favorites to any roles.
Any ideas?
Sunil

Answer 1

"The Business Explorer Browser (BEx Browser) makes it possible for you to access all document types of the Business Information Warehouse that are assigned to your role or that you have stored in your favorites. You can select and open documents assigned to you in the BEx Browser or store and manage new documents in the BEx Browser."
http://help.sap.com/saphelp_bw33/helpdata/en/7a/87583c2439e66fe10000000a114084/frameset.htm
"The Business Explorer Analyzer (BEx Analyzer) is the analysis and reporting tool of the Business Explorer that is embedded in Microsoft Excel."
http://help.sap.com/saphelp_bw33/helpdata/en/ba/45583ca544eb51e10000000a114084/frameset.htm
Hope it helps!
Bye,
Roberto