Consider the following scenario.
Scenario
A custom entity, Project has been added to a Dynamics CRM system.
There is a 1:n relationship between Account and Project. The relationship behaviour is set to Cascade All for Delete.
A user has Organization level rights on all privileges for Account and Project except that the privilege is set to None for Delete on Project. A project record, Project A, is parented by Account A.
When the user views Projects in a list, the delete button is not shown on the ribbon. If the user looks at the effective permissions (File | Properties) for Project A, the Delete box is not checked. The user opens Account A and clicks Delete. What happens?
Result
Despite the user not having permissions to delete projects, the account and project records are deleted. The cascading rule overrides the None setting for the user’s delete privilege.
This applies in CRM 4.0 and 2011.