The list of resources to association with an organization or location, for example subnets, does not honor the user's RBAC permissions. For example, if a user has a filter to see only subnet S1 but there are other subnets S2 and S3, all three will be displayed instead of just S1.

Also related, however, is the fact that the UI sends up the list of subnets on form submit as a group. This means that if the above case is fixed so that the user only sees S1 in the list of choices, this will lead to them effectively remove S2 and S3 if another user had added those. The UI needs to be fixed to perform separate add and remove operations on individual IDs rather than blindly posting back what it believes to be the full set.