Field access vs. data access
In BO Rights, you can define access permissions for fields, actions, and other elements for a specific function profile.
It is important to note that field access and data access are separate permissions.
Example
If you remove access to a picklist field, users assigned to the affected function profile will no longer see the field in the user interface (UI). However, they may still be able to view its data in reports.
This happens because restricting field access in the UI only hides the field itself—it does not restrict access to the underlying data. The picklist data remains available, but it is simply not visible in the UI.
To fully restrict access to the data as well, you must configure data authorization separately, which you can do by using authorization filters.