In our present situation we have everything under one single
BU, which meant that every user from every department was
able to see everything that was created (like cases).

To get some form of separation I've created 3 business units
and moved every employee to it's designated unit.
So far so good. Users of UnitA could no longer see cases
of UnitB and so on.

The securityroles are all (were still) attached to the root-unit,
but were copied to the child-units. Editing a child-securityrole
doesn't work, so I've tried editing them at the rootlevel
(as changes are inherited by the childroles).

What doesn't work anymore is that users cannot create cases
anymore. CRM throws an exception, that has to do with
priviliges. I don't know what is causing the problem.

1) I created extra sub-units
2) moved users to their specific units
3) the standard roles are copied to these users
(and by default set to no roles, so I've readded them, but
with the settings as they were).
4) separation of records works, but can no longer create

Solutions?