After adding catalog SAP_CORE_BC_EXT to a Business Role and setting read only restrictions, the users with this business role assigned has full access to the extensibility apps.
S/4HANA Cloud 1908
The following catalogs are part of an exception list for which R/W restrictions are not supported:
It is not possible to differentiate between the read only access and read-and-write access. If the business catalog SAP_CORE_BC_EXT has been assigned to a business role, a user with this business role has the full access to the app.
"Custom Business Objects" "Custom Catalog Extensions" "Custom CDS Views" "Custom Communication Scenarios" "Custom Fields and Logic" "Custom Logic Tracing" "Custom Reusable Elements" "Custom Tiles" "Extensibility Inventory" "SAP_BR_ADMINISTRATOR" , KBA , BC-SRV-APS-IAM , Identity and Access Management , Problem