Hi Davor,
I believe this is down to the Microflow not being setup to use entity security.
If you open the Microflow, right-click and select Properties you should see the following:
You will need to set “Apply entity access” to yes to make the actions work with the entity level access.
Kind Regards,
Josh
https://docs.mendix.com/refguide/microflow#5-1-apply-entity-access
Sounds like you might want to look at this? Without knowing where your Flow is being called from, it sounds like it’s being executed by a user who has overriding permissions, or at a level where the access rules aren’t enforced.
I can only claim to vaguely understand the intricacies of Entity Access, I’m sure there are more qualified devs here who can provide a more detailed explanation, but I hope this helps!
Thank you Josh! I had no idea that option exists, I thought it’s “always on”.