When selecting the "Active Roles" tab in Manager for a group or for the domain object, there is a message stating:
"You do not have sufficient permissions to view data in the category 'Active Roles'!"
For a user account, the available fields, "Deprovisioning status" and "Deprovisioning date" are read only:
When viewing the ActiveRoles Server (ARS) columns (e.g. edsvaSecondaryOwners, etc.) in Object Browser there is a lock icon on the column name. Hovering over the icon gives the message, "Locked by ARS.Customizer.ADSGroup":