You have to list a dummy user or another user (I do with one of the ADMIN users) for all possible values for the "*". What Madhumitha mentions is correct, the * in section access table does not mean all values in field but all values in the field of the section access table.
In your example, the second table should not grant access if using strict exclusion and open in server (Ajax or Desktop). Opening locally will work either way.
EDIT: Elaborating a bit more, if in your second table you add any other ADMIN or USER for which SECTION_ACCESS_FIELD has the value "ABC", all * users will have access to "ABC" and "ABC" only.
Also remember that when working as client - server, ADMIN roles do not exist in practice, since using the client you cannot perform tasks like reload, edit the script, etc. so the only way of providing an ADMIN full access is like what you would do with a USER: a line for each value of the field the ADMIN needs to have access to.
The advantage of the ADMIN is that it can open any file regardless of the contents and perform a reload, for example, as long as the file is open locally (or via Publisher, but the behavior here is slightly different).
Said in different words, you should not consider ADMIN as a privileged user when getting via the AccessPoint, rather than a developer who can open the file at any time, even if he cannot see any data, as it must be able to edit the file, reload the file, change the script, etc.
(Side note: that's why ADMIN role was initially removed from section access in Qlik Sense in the earlier versions. Yet, either QlikView or Sense, ADMIN should only be used for service accounts or developer accounts, not for granting more or less permissions over the data, that's what the reduction field is for)
.png "Miguel_Angel_Baeyens"){kind=avatar}
