A lot of people are using category to "jail" permission, but your issue may be related to a bug...
Please create a ticket at : https://dev.tiki.org/Wishlist
And reproduce the issue by creating a 18.x instance under the "Demonstrate Bug" field on this ticket.
Set a simple sample with your exact "not working" configuration.
- You’ll be able to see how it work in a more "neutral" environment
- Any one that will try to solve will be able to work directly on the code (and not waste time trying to reproduce)
- Once fix is committed, after 12h you can upgrade the instance and see the fix live before applying on your website.
Have a nice week-end