Turn off "Add Customers" to Guests

[Rob Peterson]

For Guest users to a project, is there a way to disable them from adding customers or editing the organizations?  I'm logged in as a "Guest" in the service desk project (i.e. an external email address - @hotmail.com ).  I'm able to Click on "Customers" - view them, go into the organization and then delete or add more people...  Is this a bug? Seems like a security oversight if I'm not an administrator, just a team-member, that I could potentially add anyone in the world... 

[Jack Brickey]

To be able to add customers or edit orgs a user must be an agent or admin. I don't know what you define as a guest but in my mind they would not have those roles. Can you confirm the roles?

[Rob Peterson]

I'm defining 'guest' as external users that are not part of our company that are invited to the project ( when click the "Invite team" button inside the project).  Although they are provided access, and they have some of core functions that an Agent would have, since they are external, there are functions that we would like to turn off.  I've managed to turn most of these features off by way of using a group and altering the permission scheme accordingly.  Unfortunately, there doesn't appear to be way to both deny access related to this question and also be able to make "external comments".  If the "Service Desk Team" (which provisions the Agent status), is removed from the project, the ability to add customers is removed (good), but the only comments that can be made within the system are "internal" (bad).  Essentially, we have a project that is being co-managed with us and our client... some of those client users will only have access to the Service Desk portal so they will need to see comments that the client "Guest" also puts into the project.