SYMPTOM:
Users who supposedly shouldn’t have access to a metric with execute ACL permission denied are still able to visualize its values.
CAUSE:
It is working as designed; users who can visualize the metric values have the privilege of Administration Bypass all object access security checks selected, as shown:
ACTION:
Disable the Bypass all object access security checks privilege under administration privileges in the user editor.
