[Observium] Limit Radius user to specific devices/ports

I’m authenticating against RSA , set the groupmemberattr Filter-ID and some auth_radius_groups with different privilege levels. What i could not figure out is how i can limit one Filter-ID to just a specific device or port.

In the GUI it’s possible to configure some Roles, once added they cannot be removed anymore via the GUI?

Thanks, Alex