Gerd,
Work status works somewhat independent from system authorization. You can't have too much authorization. Work states are saved in a table and BPC checks the table to evaluate if the area is locked or not. Can you check the work status audit report or create something in Excel using EPMWorkstatus to check if the data intersection is truly locked.
Akos