This is not a bug, this is part of the complex behaviour of the security model and can be customised if you need to. You need to look at the relationship behaviour between the parent entity (Lead in your example) and each activity type (or indeed any other type of child record). In the relationship behaviours section, the "Reparent" behavour for many relationships is set to "Cascade All". This means that if you link a child record to a parent one, it give the owner of the parent record the right to act on the child record as if it was one of their own (this will still limit their ability to do things they can't do to their own activities, such as delete them, if that is what their role says). So if you don't like this feature, change the Cascade behaviour on the relationships where you don't want it. This affects all relationships in CRM. A common example would be Opportunities owned by an internal sales person which would still be visible to the client account manager (owner of the customer Account record). This is helpful in most cases, and where it isn't, you customise it to operate differently. Cascading this down from the Opportunity to the Activities under it makes the same sense - the Account manager wants to know what the internal sales person has done in relation to the Opportunity they own.