I have a Test user in a group and I am trying give that user read-only view of a single Global collection and the Universe container on his landscape. The group privileges are OperatorRO down the line, the security string of the Global collection is set for the same as the group, but the user has no GC and no Universe under the landscape.
I figured it out. This issue was me trying to configure multiple security strings for that single GC. That will lead to my next question, which I will post shortly.