Grantee Domain not honouring Grantor domain restrictions (Domain Grants)

Hi All,

For troubleshooting and maintenance we have an independent domain in our production instance, this domain has ALL_TS READ domain grant from all other domains.
Ideally by the above grant any user in maintenance domain should not be able to create/modify any data in any other domain, only able to view the data and understand the issue. But what we notice is user in the maintenance domain is able to edit some of the data.

Grantee Domain is only having read access, I have checked from both front end and back end.

Please help me in solving this.

Thanks,
Siva.