PS Network characteristic authorisation

Hi all, 

Our requirement is to restrict some users from entering values for a specific characteristic in a network (not maintaining the characteristic). In the example that I have created I have used authorisation object C_TCLS_MNT according to the document below. I also have configured 2 organisational areas (E, N) 

http://wiki.scn.sap.com/wiki/display/PLM/Authorization+Objects

The example I have created in our test system is the following: 

class ZPS_CHAR_TEST

Characteristics ZPS_CHAR_TEST and ZPS_CHAR_TEST2. 

For the first characteristic the organizational area in the class is se to to E whereas for the second it is N. 

 

In PFCG, in the user role I have added authorisation object C_TCLS_MNT and allowed access ONLY to organisational area E. 

However when I go to CN22, the system allows the user to enter values for both characteristics? I was expecting to be able to enter a date only for the first characteristic. I want the second characteristic to be "Display" only

Am I using the correct authorisation object or should it be something else? What am I doing wrong?

http://wiki.scn.sap.com/wiki/display/PLM/Authorization+Objects