SYMPTOM:
According to the System Administration Guide Product Manual as well as KB9119, “If an administrator explicitly denies a certain permission to a user group on an object and explicitly grants the same permission to a user within that group, the user group’s setting prevails in Strategy Developer 8.x and 9.x.” This is true in Strategy Developer 8.x, however it has changed in 9.x.
If a user is in a group that has “Denied All” for an object and the user is then explicitly given permission for that object as well, the user’s setting prevails in Developer 9.x.
CAUSE:
In 8.x, the deny privilege is setup to override the grant privilege regardless of what level the deny/grant privileges are applied. In 9.x, the user level grant privilege overrides the deny privilege of the user group.
ACTION:
Do not explicitly give a user permission to an object if they should not have access to it even if they are in a group that has ‘Denied All’.
