Hi,
You need to go to the project security, in your project module. Here you can assign module roles to user roles.
This defines which user has what rights in different modules. So a user can have write access in one module but read only access in another module.
Also I think you need to have the security level on production.
See the screenshot.