Record the peer the server evaluates
Tvheadend's developer notes describe access-entry matching using identity and the requesting peer's source-network context. Testing the same username from another device or network is not necessarily an identical access test.
Compare applicable entries
For each local test context, record the address as seen by the server and which enabled rows can match. Include any relevant anonymous entry. Preserve the existing order and merge settings while making the comparison.
Do not widen an allowed-network range simply to make an unexplained test succeed. First state the intended scope and identify which row should provide it. Keep detailed network and credential information private when preparing a sanitised support note.
Retest a specific permitted task
Use the intended ordinary operation and one operation that should remain unavailable. Record the result with the client context. No access tests were performed for this article; a successful login alone does not establish that the entire effective permission set is correct.
Questions answered
Is a username alone enough to reproduce an access match?
No. Include the source context and all applicable enabled entries in the review.
Should I broaden the network scope as a first diagnostic step?
First understand the intended scope and matching entries, preserving the administrative recovery route.
Sources & further reading
Official references for the subjects discussed. Service terms and device software can change.