I have a node on CRX with rep:policy deny jcr:write to everyone, I have modified permission programatically because I need to activate / deactivate permissions according to property, but users on administrators group can modify node. Why?? Any suggestion? I am working with AEM 6.5 Thanks.
by default administrators group has full control - the precedence is deny first and then allow, as the admin group has full access, the users on admin group will get automatically all access including modify.
You can try create a custom admin group and add those users, then provide necessary access.