When you assign security to a rollover volume, things are a little complicated. If you assign rights to the parent part of the rollover volume (for instance clicking on DEFAULT in the Volumes area of Admin and setting security on that), you do NOT affect any security on existing subvolumes. You are actually settings security for any future rollovers that get created. If you expand the tree in the Admin console under the parent volume so that you can see all the subvolumes (DEFAULT000000, DEFAULT000001, etc), each of those has its own security as well. You should change security on both the parent and the subvolumes to be sure you cover all your bases.