Generating role transport request in production system

Hello all,

I am just curious about the fact that we are still able to generate transport request containing roles with T-Code: PFCG even we have the client setting correctly set (i.e. No changes allowed, No Changes to Repository and Cross-Client Customizing allowed) in our production system.

Of course, we can still use T-Code: SE10 to manually create change request and include objects, so on so forth.

Is there any official SAP documentation on this?

Your response/input is highly appreciated,

Regards,

Chi Wo