Correct Group DB Rights Override

I have assigned DB rights via a User Group to a "Root Working Folder". The User has rights to Create New Sub-Folders under that Root Working Folder to hold artifacts related to different projects they work on.

When the User Creates a New Sub-Folder under the Root Working Folder they receive Direct DB Rights to this Sub-Folder and anything they create in or under that sub-folder. I was told by Software AG Support that this is "expected behaviour" which I cannot believe as it totally breaks the reason for having the Users ONLY have assigned DB right via the User Group. Every time this occurs I have to MANUALLY go in via Aris Administration, FIND and REMOVE these directly assigned DB rights so that once again the User ONLY has DB rights via the User Group.