Kustomize image tag override not shown for User

[superfly-git]

I have a team of users that will need to have access to do whatever they want only into one App Project.

ArgoCD is deployed using Helm chart v3.15.0.

In the values yaml i have the below config for RBAC.

User role a-team is retrieved through a connected instance of KeyCloak where users use to sign in to argocd.

      p, role:a-team, applications, *, my-services/*, allow
      p, role:a-team, projects, *, my-services, allow
      p, role:a-team, repositories, get, gitops-manifests, allow

      p, role:denyallaccess, applications, sync, */*, deny
      p, role:denyallaccess, applications, create, */*, deny
      p, role:denyallaccess, applications, delete, */*, deny
      p, role:denyallaccess, certificates, get, *, deny
      p, role:denyallaccess, clusters, get, *, deny
      p, role:denyallaccess, repositories, get, *, deny
      p, role:denyallaccess, projects, get, *, deny
      p, role:denyallaccess, accounts, get, *, deny
      p, role:denyallaccess, gpgkeys, get, *, deny
      g, role:a-team, role:denyallaccess

      g, myTeam, role:a-team
      g, Admins, role:admin

The problem is that when a user that is assigned this role logs in, is able to see the applications in the my-services project but navigating to App Details > Parameters. Kustomize settings are not shown as they are setup. It only shows a Directory params screen which is not related to the app. As an admin i can correctly see the correct Kustomize image params when i navigate to the Parameters section.

Is this how it should work for normal users or it can be fixed by setting a different set of policies??