Even in SCUM all are "global", child system still can create users

Experts:

I have followed my CUA document which has been verified by me many times.

But for my current CUA project, I still can create users from SU01 at child systems.

I do not see anything different. On SCUA, every check is green for model CUA.

Did you experience the same strange thing?

Thanks!