[Erp5-users] Please help with of Base Category and Security interplay

[chetankumar at vsnl.net]

Hi all
The utility of base category has not sunk in for me. No amount of changes/experimentation has not yielded a different output for me till now.
Example
user1 (validated) has these settings in an open assignment
group = group/ga
function = function/funca
site = site/sitea

I define Assignor local role for person module with categories
group/ga
function/funca
site/sitea
(same as above assignment)

user1 can access the module (which is expected behaviour)

Now I create ERP5Type_getSecurityCategoryMapping
==========================================================
return (
('ERP5Type_getSecurityCategoryFromAssignment', ['function'] ),
('ERP5Type_getSecurityCategoryFromAssignment', ['group','site'] ),
)
==========================================================

user1 can also access the module if
1. category=function/funca
     function is returned by ERP5Type_getSecurityCategoryMapping
2. cateogry=site/sitea
                      group/ga
     site and group are returned by ERP5Type_getSecurityCategoryMapping

The moment I set 
1. base category=function or 
    base category = group site
    for 1 above, the module is not accessible.
2. base category = function or
    base category = group site
    for 2 above, the module is not accessible

What is base category designed to contribute to the access control?
The document on the new security has left me confused (maybe it is just me)

Regards,
Chetan