We are currently on Netweaver version 10.0, SP13, Patch 4, NET 3.5, Build 8308. We implemented matrix security for go live last year as our security parameters are quite complex. Everything seemed to be working fine, but today someone brought an issue to my attention, and it looks like it isn't working. An example:
User has two access profiles:
Profile 1
CORP = US
DEPT = ALL
Profile 2
CORP = ALL
DEPT = IT ONLY
Under those parameters, expectation is user can pull any DEPT from US (profile 1), any IT cost center from ALL (profile 2) - but should NOT be able to pull a cost center OUTSIDE of IT for WW, NOR should they be able to pull consolidated results, which would be the intersection of DEPT = ALL from profile 1, and CORP = ALL from profile 2.
However, user is able to pull any cost center outside of IT for the world, and can pull consolidated.
Under what circumstances would matrix fail to function as intended?