Yes, what you have recapped is correct. To further explain, each user has a class in their metadata called, app_cara. This class has an attribute called superuser, which is a boolean. An administrator would add users to the RMP application. This admin would have to manually set the permissions of each user. In this case, if an admin wanted to give a user access to everything then he would assign them 'superuser' privileges, doing so by checking the superuser checkbox in that individuals metadata.
In the superuser organization the code looks like this => ${get_user_metadata().app_cara.superuser} . If that evaluates to true then the user has superuser privileges.
Now, the issue is that when an admin physically goes into the user's metadata on the actual RMP ide to check the box the privilege is not set and the condition above evaluates to false. However I have noticed that if I was to then go back into that same user's metadata and click on the edit icon then the save icon, without editing anything, then the previous change would take affect. I will point out that the checkbox from the previous change does show that it was checked. It is only when I actually go to test that I can not see a change in permissions.
When I say test, I mean I open the RMP application as a superuser and what I expect to see are the header links which have permissions set as such; "visible" : "${has_right('221934')}", ( 221934 is the id for the superuser organization). I do not see these links on the first save attempt, but I do after I edit/save again.
I hope this clears up and confusion.
Thank you for your time and I look forward to your response,
Travis Vliegen