Visitors can still break entities

I made a roleplaying map with armor stands, minecarts, and item frames. I made sure everybody had building permissions turned off. I let my friend play. Soon enough when he left, i found some of the minecarts, armor stands, and item frames missing. That is very annoying and I will not let anybody on that game until the bug is fixed...