Hi All. I've found that security access is inheriting through the Regarding field on activities. For example, the owner of an account has access to all the activities which are 'regarding' the account.
For example, suppose 2 sales reps have user-level write access to activities. So they can only edit their own activities. Sales rep 1 creates an activity and sets the 'regarding' to be an account which is owned by sales rep 2. Now both users are able to edit the activity.
I've tried this with multiple activity entities, and multiple 'regarding' entities. This is CRM Online 9.0.1.459.
Is this by design? I've never seen this documented anywhere.