Are there any other overriding permissions lower in the tree? Eg, is Suzy a member of the Read-Only group somewhere?
It might be a good time to look at auditing your vSphere permissions, creating a new AD group (Local vCenter Server Admins(or something)) and giving it Admin rights to your vCenter objects, making sure it works and then removing the permissions to vCenter from the local Administrators group. Creating a read only AD group (vCenter Read only) and applying it to the vCenter objects and so on and so forth.