Timecard in error can be modified by Line manager even if not enable in worker time entry profile

Summary:

As Line manager able to modify start time and end time when the time card has the status "in error"

My client needs is to have Line Manager only able to approve/reject timecards and approve/reject change request. LM should not be able to edit a Timecards.

Content (please ensure you mask any confidential information):

Worker time entry profile has been set to let line manager only "view" timecard, all other status cannot be modified by the line manager :

But when the status of the timecard is "in error", the line manager can modifiy the timecard.

The custom role has been created to remove all possibility of edit or modify, but the role :