Hi,
This might be a simple one...
I have 2 catalog services, Prod and Testing. I have catalog items in both.
I've configured 2 entitlements, one for each catalog service.
The first entitlement allows users access to Prod, with a limited set of Entitled Actions.
The second entitlement allows the same users access to Testing, with a bigger set of Entitled Actions.
What seems to happen is that if I deploy a catalog item from Prod (as a user that's a member of both entitlements), I get the Entitled Actions from prod and all the Entitled Actions from the Testing entitlement. This means I can do things to Prod machines that I shouldn't be allowed to :-)
Is this how it's supposed to work?