Both groups are global.
I will try the batch.
The problem, at least as I perceive it is that I have to assume in the script all the combination of groups any user might have, and act accordingly to said combination.
It seems to ignore if I try to make selections based on one membership at a time.
I might be wrong, but what I sense it is happening is as follows:

User A is a member of both groups Mgt and Mgr.

Tests in my script:

If member of Mgt, map O:

If member of Mgr, map R:

When user A signs, he only gets dribe O:, as the script seems to ignore any other membership once it acts upon a previous selection. Am I wrong?