Hi,
Not sure how did you setup the permissions so I cannot help you much. Are you using 2.20 or 2.21 beta? One thing that affects the spy/listen/record buttons is the privacy setting (that is not a permission per se). So you must factor that as well.
Fop 2.20 permissions are global, you will be able to perform the actions to all the buttons you see on screen (except for the ones with privacy set). So if you have the "record" permission, you will be able to record calls for all the extensions you see. You can limit the extensions you see by creating a group and assigning it to the user, thus that user will only see the buttons for the groups he is allowed to see.
In Fop 2.21 permissions are extended, and you can limit an action to a particular group, but without enforcing the group to the user, only the actiions themselves. So you can see all extensions, but allow permissions to an extension subset. This is available in the "fop2 permissions" menu for fop2admin 1.2.6, and works only on fop 2.21.
Best regards,