Steps to reproduce:

1. Create Host group "Test"
2. Create User group with RW access to host group "Test" and Zabbix User role
3. Create user in this user group
4. Make API request host.create to create host in group Test

Result:
Host is created
Expected:
User should not be able to create host

Comment:

User with Zabbix User role does not see Configuration menu and can not create and delete host in Web UI. But he can create and delete hosts via API. It seams that API allows more actions for user than should be.