In TFS 2017 Update 1 (On-Prem) there is a release definition with a manual intervention step in between. The manual intervention notification is set for a group where an user User1 is not part of. User1 has Builder and Project Admin rights; And is also part of the TFS team.
During the manual intervention of a release User1 is able to resume or reject the release. But we don't want this to happen.
I could not find the rights in TFS Microsoft online documentation for being able to do this.
What rights are needed to resume or reject a release after a manual intervention step?
P.S. In TFS 2018 RC2 too I noticed the same scenario.
When the Manual Intervention task is activated during a deployment, it sets the deployment state to IN PROGRESS and displays a message bar containing a link that opens the Manual Intervention dialog containing the instructions. After carrying out the manual steps, the administrator or user can choose to resume the deployment, or reject it.
Users with Manage deployment permission on the environment can resume or reject the manual intervention.
If you don't want the User1 be able to resume or reject the release. You could deny the Manage deployment permission for that specific user. More detail info about it please refer: The Manual Intervention task