AWX WebSocket subscriptions skip RBAC checks for global broadcast groups. The consumer_access() function in awx/main/access.py maps only object-level event groups to access classes:

class_map = {
    'job_events': JobAccess,
    'workflow_events': WorkflowJobAccess,
    'ad_hoc_command_events': AdHocCommandAccess,
}
return class_map.get(group_name)

When a client subscribes to a broadcast group such as 'jobs-status_changed', group_name is 'jobs', so consumer_access() returns None. The consumer in awx/main/consumers.py only runs user_can_see_object_id() when the access class is not None; otherwise it adds the user to the requested group unconditionally:

access_cls = consumer_access(group_name)
if access_cls is not None:
    if not await self.user_can_see_object_id(user_access, oid):
        continue
new_groups.add(name)

The job model emits global status updates to 'jobs-status_changed' including job IDs, status changes, timestamps, and instance_group_name. In multi-organization deployments, a low-privilege user from one organization can receive real-time status metadata for jobs in all organizations that are otherwise hidden by the REST API.