Previous versions (before 2.0) allowed for granular can_edit DAG permissions so that different user groups can trigger different DAGs and access control is more specific. Since 2.0 it seems that this does not work as expected.

How to reproduce:
Create a copy of the VIEWER role, try adding it can dag edit on a specific DAG. **Expected Result:** user can trigger said DAG. **Actual Result:** user access is denied.

It seems to be a new parameter was added: **can create on DAG runs** and without it the user cannot run DAGs, however, with it, the user can run all DAGs without limitations and I believe this is an unintended use.

tests/www/test_views.py
"""Do not show external links if log handler is local."""
        url = f'{endpoint}?dag_id=example_bash_operator'
        with self.capture_templates() as templates:
            self.client.get(url, follow_redirects=True)
            ctx = templates[0].local_context
            assert not ctx['show_external_log_redirect']
            assert ctx['external_log_name'] is None
    @parameterized.expand(["graph", "tree"])
    @mock.patch('airflow.utils.log.log_reader.TaskLogReader.log_handler', new_callable=PropertyMock)
    def test_show_external_log_redirect_link_with_external_log_handler(self, endpoint, mock_log_handler):
        """Show external links if log handler is external."""
        class ExternalHandler(ExternalLoggingMixin):
            LOG_NAME = 'ExternalLog'
            @property
            def log_name(self):
                return self.LOG_NAME
        mock_log_handler.return_value = ExternalHandler()
        url = f'{endpoint}?dag_id=example_bash_operator'
        with self.capture_templates() as templates:
            self.client.get(url, follow_redirects=True)
            ctx = templates[0].local_context
            assert ctx['show_external_log_redirect']
            assert ctx['external_log_name'] == ExternalHandler.LOG_NAME
class TestConfigurationView(TestBase):