Why the user who is not authorized is able to create dashboard/reports in kibana

Elastic Stack Elasticsearch
3

Thanks Jay for your prompt response .
Here is my role(teacher,stu) definition in roles.yml

teacher:
indices:
'student_info,class_detail':

  • indices:admin/mappings/fields/get
  • indices:admin/validate/query
  • indices:data/read/search
  • indices:data/read/msearch
  • indices:admin/get
    stu:
    indices:
    'student_info':
  • indices:admin/mappings/fields/get
  • indices:admin/validate/query
  • indices:data/read/search
  • indices:data/read/msearch
  • indices:admin/get

The required permissions for kibana 4 users.

kibana4:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'*':
- indices:admin/mappings/fields/get
- indices:admin/validate/query
- indices:data/read/search
- indices:data/read/msearch
- indices:admin/get
'.kibana':
- indices:admin/exists
- indices:admin/mapping/put
- indices:admin/mappings/fields/get
- indices:admin/refresh
- indices:admin/validate/query
- indices:data/read/get
- indices:data/read/mget
- indices:data/read/search
- indices:data/write/delete
- indices:data/write/index
- indices:data/write/update
- indices:admin/create

Now coming to second point with the gopal user I can see 11 records in the discover page for class_detail index however if I add fields it shows no data .