The profile settings are configured to restrict functionality, but still, the users are getting access to functionality. You have been asked to debug this behavior.
Debugging steps
The following steps will help debug this problem:
Double-check the profile settings for the profile that has been restricted.
Go to the user's page and see if the user has a permission set assigned. The permission set provides extra access and overrides profile restrictions.
