AHA!! What a pain! The access controls work now that I have disabled replication. :-/ errrr ... sorry about that ...
I guess I don't understand how access rules and replication interact very well then.
I would have thought there would be now overlap at all?