You followed below document and created user with subaccount viewer role, but found this user could create/delete service instances.
SAP Business Technology Platform, Cloud Foundry environment
subaccount viewer role, creating/deleting instances , KBA , BC-CP-CF-SEC-UI , SAP Cloud Platform Security UI Components , Problem
About this pageThis is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).
Search for additional results
Visit SAP Support Portal's SAP Notes and KBA Search.