It is not unintended behaviour or a bug. It is by design. Seehttps://apps.db.ripe.net/docs/Authorisation/Protection-of-Route-Object-Space/#authorisation-rules-for-creating-route-objectsThere used to be a flow chart showing this but I can't find it now.