1. Create host group "test_host_group".

2. Create host "test_host" with:
Templates: default "ICMP Ping"
Host groups: "test_host_group"
Interfaces: default snmp 127.0.0.1

3. Create user role "test_role_admin" as "Admin" user type with default checkboxes.

4. Create user group "test_group_ro"
Frontend access: Internal
Host permissions: add "test_host_group" as "Read" access

5. Create user group "test_group_rw"
Frontend access: Internal
Don't add hosts to this group

6. Create user "test_user"
Groups: test_group_ro, test_group_rw
Permissions - Role: test_role_admin

How login as "test_user" and check permissions. Search "test_host".
This user access to host lastest data and don't acces to edit host. This is what as expected

7. Login as Admin. Go to user group "test_group_rw" settings and add read-write acces to host group "test_host_group"

8. Login as "test_user" again and check permissions. Search "test_host".
This user access to host lastest data and acces to edit host. This is what as expected.

9. Login as Admin. Go to user group "test_group_rw" settings and remove read-write acces from host group "test_host_group".

and check "test_user" Permissions. Looks what as expected, but...

10. Login as "test_user" again and check permissions. Search "test_host". Now this user don't acces read acces to "test_host"

Expected: read access should remain since this user is a member of the "test_group_ro" group.