REST API - Read Only privileges but data can still be updated - Worker and Assignment

Summary:

We need a role that meets the following requirments:

1. Allow update of Username and primary email address
2. Allow update of a specific Person Extensible Information value
3. Retrieve all Workers including assignments (read only)
4. Retrieve Org structure

We checked and found that with the below Roles/Data Security Policies, the REST API allowed the Name of the person to be updated as well as allowed changes to the Assignment. Maybe the Name can be updated because it is part of Person Detail (in that case, how can we limit write access to Person Extra Information only, this is what the name of the role suggests?). But everything related to Assignment data all is "View…", not Manage. What am I missing?