More security on Data / Action with DXP Merged

Hello

Here is our problem.
Team A create Information Link and DXP file, and publish it in Web Player.
On Web mode, Team A can Access and Modify, and Team B can just Access.
The DXP has the option "Autorize Web Customer" to NO, so that Business Author can't edit.

In Team B, we have someone using Analyst tool for his work, on his data.
He open that Team's A  DXP file with Analyst, and can access and modify every thing.
The Data is supposed only to be access as Readable..... But then no.

He need to access Team A work, but not to modify and save (on his place), Team's A DXP.

It is a big security failover. Is there anyway to do better please?

Thanks
Virginie