Steps to reproduce:
- create a work group with 2 users Mary and Peter; Mary is the group manager
- create a patient record and set the group to be the owner of the record
- login either as Mary and Peter
- try to make any change (add/remove collaborator; make record public, etc)
Observed in the family record form as well.
This problem does not exist in version 1.3.7.
In 1.4RC1 I was able to modify permissions via REST API.