We have a cloned platform manager role to allow Development staff the ability to do the online registrations but all other things unchecked. Staff with the role can update photos despite it not being checked and I was told that anyone with a platform manager based role can regardless of whether checked. I expect cloned roles to have only the tasks I enabled for that role. This does not bode well.