I find the Restrict Access naming very ambiguous and always have to test it to confirm how it works. This screen is not restricting access but Granting access. I click a user Role to grant it access. I accept that deselecting is restricting but .....