Unexpected permissions added to administrator when using the UI

Problem/Motivation

I have an OG role "node-my_group-administrator" which is NOT an admin role, i.e., the is_admin flag is NULL. The OG role has 2-3 custom permissions stored. When I visit /admin/config/group/permissions/node/my_group, I'm noticing a lot of permissions already checked and their checkboxes are disabled. Few cases: "administer group", "administer permissions", "add user", etc. Note that these pre-selected and frozen permissions are not set in the role's config entity.

When I save, without any changes, the OG role receives all these unwanted permissions. I can see this on a config export.

If I follow the same steps programmatically:

OgRole::load('node-my_group-administrator')->save();

...nothing is changed inside the OG role config, which is what I'm expecting.

Proposed resolution

?

Remaining tasks

User interface changes

API changes

Data model changes