Users can also have access to data partitioned to their own class or subsidiary, too. That's another thing to check.