Hi Abhijit,
According to me the authorization check works as expected. Company Code is not used in the selection so it will display the aggregated values because of the aggregation authorization (the colon : authorization).
In order to avoid the issue described above, I suggest to make the input-ready authorization variable for Company Code mandatory to force a selection on Company Code. Now only authorized Company Codes (i.e. ABC) can be selected.
Best regards,
Sander