Sap priveleges SPRO

Hello,

I'm trying to give read only access to SPRO but have no idea how to do it... I tried to use some topics here. For example:

SPRO Display

Setting SPRO authorization only in disply mode | SCN

and various... But it does not work for me.

In my case i have user with role sap_all (i guess this permissions allow user alot to do).

And i created a role as it was discribed in topics above.

So... If user is a member of two roles. In first role SPRO is allowed to edit, in second role SPRO alowed only in readonly mode. Which permissions will work? i thought "deny" always has a priority.. but it seems like in SAP it work another way...

Thanks in advance for any advices