Symptoms
Provider has removed some privileges from "Full Access" role of the customer (Home>Operations>Customers>[customer]>Roles>Full Access>Privileges). But later they were added back automatically.
Cause
When service template is create privileges from "Customer Full Access" role are copied to it. Later these privileges are used for creating of the first role "Full Access" of the customer when first subscription is provisioned. Also during provisioning of new sales order for the customer, PBA-E checks "Full Access" role and if it finds some privileges that not present in "Full Access" role of customer, but present in service template for sales order that is being provisioned, then PBA-E adds these privileges to customers "Full Access" role.
Resolution
Please to not edit "Full Access" role of the customer. Instead create new Role in Home>Operations>Customers>[customer]>Roles>Add New Role , include necessary privileges in it, deaasign "Full Access" role from the user, and assign new role.