In baseline permissions interface, you have at least two ugroups displayed: [Project members, Developers] Developers is already selected as baseline administrators. => If you want to switch Developers as readers only, then you have to do it in too many steps: deselect it from administrators, submit, select it from readers, submit :(