If the name you specify is listed explicitly in the ACL, then QueryAccessRoles returns the roles for that ACL entry and does not check groups.ist das je eher anderst herum zu vermuten (also beim User sind sie da und nicht bei der Gruppe, weil dort ev. ein anderes Adressbuch herangezogen wird)
If the name you specify is not listed explicitly in the ACL, QueryAccess checks to see if the name is a member of a group in the primary address book where the program is running: on a workstation the Personal Address Book; on a server the Domino Directory.
varRoles = db.QueryAccessRoles(session.UserName)
varRoles = Evaluate({@userroles})