restrict delivery to components in a stream

I'm trying to use the "restrict delivery to components in a
stream" precondition to restrict who can deliver to a stream (a
single role in the team that owns the stream). I thought it would be
easier to configure this during lockdown phases of our projects than
flipping permissions or setting up a separate team for locking
purposes.

However, I found a user can deliver if they're in ANY parent process
area (team or project) with this role. For example:

Team Org

Project P
--- Team T

Setup

Stream owned by team "T"

role "R" is allowed to deliver in project "P"
user "U" has role "R" in project "P"

In team "T" process customization, the "Deliver
(server)" precondition set for "Everyone (default)"
and configured to restrict deliver to role "R" of team
"T"

Results

User "U" can deliver even though they're not a member of
team "T".

Questions

Am I missing something?
Is there another way to easily lock a stream?

Appreciate any help

Yes, if you have a role in a parent project/team area, then you have
that role in all child team areas, unless you are explicitly given
different roles in those child team areas. Explicitly removing those
roles isn't a very scalable solution, since it means you have to
know/remember to remove those roles for anyone new added to the parent
project/team area.

What you probably want is work item 89455 "Allow turning off role
assignment inheritance from a team area". If so, you might want to add
a comment to that work item indicating your interest/support.

Until that work item is implemented, the best approach is to not give
that role to any members of the parent team areas (which might mean
creating a new leaf team area, for the work currently being done in the
parent team area).

Cheers,
Geoff