Hi,   I believe what you might "hit" here are conflicting permissions where deny simply takes precedence.   When you have denies and grants at the same time, the deny will always take precedence.   Maybe someone else has some ideas on it, but I am thinking that you might have to restructure and rethink the way your groups are being set up.   You cannot have one user in two different groups where one group has a grant and the other a deny. The option to grant would be to assign permissions to this user directly, as a direct ACE will take precedence over group permissions.   To give an example:   Dataset A   User X is in group A … DENY on data set A for group A User X is in group B … GRANT on data set A for group B   Assign user X explicitly to data set A and grant permissions. With the explicit ACE on the data set, all permissions for user X in groups are overwritten as the explicit Grant takes precedence.   You might be familiar with this, but if not, you might find this helpful: http://support.sas.com/documentation/cdl/en/bisecag/69827/HTML/default/viewer.htm#n0pt0r7u55rqu2n1cdu2wvt47j78.htm   Would it makes sense to maybe restructure your groups and the members of the groups?   Best Anja   ... View more