It may be a "problem" for you, but it is working as designed. All connected users/clients have access to a single runtime instance of node-red -- so there is no multi-tenant solution readily available.
As mentioned, you would have to have 3 instances of node-red installed, with different subsets of your master flow running for each other user. Another option is to not use the dashboard, but that means you'd have to build your own web pages using something like node-red-contrib-uibuilder.
One other technique I've used is to have the navigation between the pages determined by sending msgs to a central ui_control node. That way, you can redirect someone away from pages they should not see, until they have entered some "password" or "keycode" that allows them to get to that page. If that would work for you, there is more information posted in this discussion thread. There is also another post that shows a simple keypad implementation that might be useful for you.
