This can be changed in Module "System" then going to "Settings" there select is an (Access Group) and remove the following (Action)"Disallow Posting Project actuals if not Project Member"
Hi, Paul.
Sounds like you're talking about REST API. And that your are overwriting data with older values if B managed to read record before A finished to update it. Classic conflict resolution ...