Access Restriction to target systems in GRC 10

Hi,

I need some advice on restricting the target system access.

Currently my GRC 10 is connected to 3 different ERM systems. We have 3 different support group users and would like to restrict them to perform RAR for a particular system.

eg. User A only can perform ARA & EAM in System A with Ruleset A, User B only can perform ARA & EAM in System B with Ruleset B  & etc

I've tried to restrict all the auth obj field GRAC_SYSID & GRAC_RSET for User A & User B.

However, the restriction only reflected on Access Dashboard. The Users still can access to all system & all ruleset when they perform User level RAR & User Level Simulation etc.

Please advise how can do the restriction on system & ruleset access?

Thank You.