Permission not respected as configured

Problem/Motivation

I configured 2 ticket types. One of them should be used by anonymous users. The other one only for authenticated users.
The generic permission Create new Ticket entities seems to be required for any of these to work.
However, the anonymous users can access the ticket form that was configured without access to anonymous users.

Steps to reproduce

Create two ticket types and set permissions for one to only be allowed to authenticated users. Sign out and access the form to add an entity for that ticket type. It will show up even though the permission was set only for authenticated users.

Proposed resolution

Look into how permissions are built.