the question is: • I'm using AzureAD. And I want to restrict the default group from having access to execute shell. What bugs me was some cluster were prevented (disconnected when exec), and the other cluster didn't. What exactly defines this behavior?

I just realize the permission not cluster-wide, but per project. After trying it, it works... thanks anyway, I hope it will solve someone else's problem 😁