Users with `user` role can delete container using controller REST api

I found that a user only with `user` role can delete container using controller REST api (e.g. DELETE http://127.0.0.1:8080/kie-wb/rest/controller/management/servers/$SERVER/containers/$CONTAINER), which I think is not allowed in Workbench UI.