I have followed my CUA document which has been verified by me many times.
But for my current CUA project, I still can create users from SU01 at child systems.
I do not see anything different. On SCUA, every check is green for model CUA.
Did you experience the same strange thing?