Secondary Usergroups not Overriding

[K Software]

I'm scratching my head on this one because I've done this dozens and dozens of times.

I have a forum that I want to grant special access to. I created a secondary usergroup with "All Yes" set for the forum in question, selected that usergroup as a secondary on a user but the secondary isn't overriding the user's primary usergroups denial of access to the forum. It's the most straightforward thing in the world so I can't figure out where I've gone wrong. If I add read permission to the user's primary group it works fine and it also works fine if I set my new group as the user's primary group (but that's not what I want to do). If it works as a primary group then that tells me it isn't a usergroup-level problem. It seems like the secondary groups just aren't overriding the primary like they're supposed to.

Is there some trick I'm missing? I'm using 4.2.0