Problem

The customer needs EDIT access REVOKED for all users of this DTSS tenant. They need to READ and Run EXPORTS from DTSS tenant. No one should be editing records on the DTSS Tenant.

Solution

The user had the following roles in the customer tenant.

• ROLE_API
• ROLE_USER

Both ROLE_API & ROLE_USER system roles grant the UPDATE access to the user. 
To subscribe to the DTSS you only need the following system roles for the data tenant.

• ROLE_DTSS_ADMIN
• ROLE_DTSS_DEPLOYER
• ROLE_DTSS_DT_MANAGER

The next action should be to remove the ROLE_API & ROLE_USER role and carry out the regular operations. You should have the Tenant Customer Admin role to remove the above roles for the DT and carry out your regular operations.