AEMaaCS DAM permissions - limit one folder to jcr:read, others jcr:all

I have set the following permissions in a user group where I want them to be able to have all access to the DAM except for the training documentation folder where they should only have read.

I thought this would be simple but it doesn't seem to be working as the user in this group can edit an asset in the /content/dam/aem-training-documentation folder.

What am I missing?  Thanks!