CDI's aggregated read-only ClusterRole (cdi.kubevirt.io:view) explicitly grants create on the datavolumes/source subresource. CDI's clone authorization logic treats this permission alone as sufficient to authorize cloning any named PVC's data into a new DataVolume, regardless of whether the caller has any other access to that PVC or its namespace. Any principal bound to view (commonly done via ClusterRoleBinding, and unavoidable in practice since CDI ships this role labeled for aggregation into Kubernetes' built-in view role) who also holds ordinary write access (edit/admin) in any namespace can clone any PVC in the cluster, bypassing the read-only intent of view.