Permissions are strict on using a Role that was derived for the Resource in question

[interlock]

Prevent a role derived from a different combination of Profile/Resource from being using with a different Resource.

[interlock]

I think we will make this configurable as none, warn, error so people can play it loose if they choose.