Hyperion Planning Security Question

Hi,

Hyperion Planning - 11.1.2.2.300

I have a user security role assigned to Totco (Write, all decendants inclusive).  However I have a user saying they cannot submit data to a lowest level entity (A2284).  To fix the issue I assigned the user role access to write to member A2284 and they were then able to submit data.  Why did the security assigned at Totco not take effect for all decendants?  See screen shot.  Is there a proactive way I can check this?

Worth nothing - this role is not assigned any security between Totco and A2284.

Any help is much appreciated!  Thanks.