Confused about Aggregation authorization (Colon authorization)

Hi All,

When I use the Aggregation authorization(in BW 7.4), I found that it show the data that I think should not be authorized. For example,

Company
Sales amount A 100 B 200 C 300

User1 has authorization to see only company A and B. I think User1 will see only 300 when he open the report but it show 600. For my understand, Aggregation authorization will aggregate follow the user's authorization. Please correct me if I am wrong.