Every time execute Role access update the Document Action Access all reset. For example if you restrict a role so that he cannot complete a sales order. After you execute Role access update this restriction is gone.
Use Case
1. Login as GardenAdmin
2. open Role Window (under System Admin/General Rules/Security menu)
3. Select GardenWorld User
4. Click Document Action Access tab
5. Uncheck Active field of Any Document Type
6. execute Role Access Update (under System Admin/General Rules/Security menu)
7. go back to Role Window
8. Select GardenWorld User
9. Click Document Action Access tab
10. notice ALL you uncheck Active record will be active again <====bug
I report this in http://jira.idempiere.com/browse/IDEMPIERE-66. Thanks!