I have a local installed QlikSense Server to play around with the QMC.
First of all I imported one of the example apps to the "Everyone"-stream. After that I have created a custom property called "UserType" with the values "Developer", "Consumer" and "Contributor" (Resource Type = User). Furthermore I have deactivated three security rules and created three new ones according to the following example:
Now I defined my licensed user "sense_test" to have the custom property "Consumer" and as expected I am not allowed to create e.g. new sheets or bookmarks on the hub. But if I change the property for my user now to one of the other two nothing changes. The hub still showing me the authorisation as defined in "Consumer".
If I delete the app now, import and publish it again the authorisation will change.
Is it a missing setting/configuration option or just because of my local installation? I have done no changes to the configuration at all besides the defined deactivation of the existing rules etc.