Hi,
I have a similar concern, I am building a Splunk app to capture user input and then POST it to an index. Users have edit_tcp capability and they can post data to any index irrespective of whether which they have read access to it or not.
... View more