* Restrictions for the user role are not bound when VM is power off. 
* create a custom role and restrict to add disk to vm. This works only when the VM is running. Once the VM is power off, the disk can be added. 

OCV 4.16

Always

1. Create VM roles such that to restrict adding disk.
2. The role will restrict when the VM is running. 
3. Once the VM is turned off, the rights changes and you can add disk. 

The rights are changing for VM after VM is poweroff

VM rights should not change with VM state change.