Users with a single role can open the primary object records if the following conditions are satisfied:

Primary object must satisfy all the data security filters that exist on the primary object’s column.
Primary object must have at least one record passing the security restrictions enabled on each child tab with data security.

For example, consider a data security model in which a user has the role, Sales Manager- NY and has the following security filters configured:

Filter 1: State code is NY.
Filter 2: Phone type is Business and Home.
Filter 3: Person salutation code is MR.

Using this data security model, consider a scenario where the database has a primary object record, Mr. Steve Nash, who has the billing address in NY state and Business as phone type. User with Sales Manager- NY role can open the Mr. Steve Nash record on the data view as the primary object satisfies filter 3 and its children satisfies filter 1 and filter 2.

Using the same data security model, consider another scenario, where the database has a primary object record, Mr. Carlos Booser, who has the Bill Address in NY state and Mobile as phone type. User with Sales Manager- NY role cannot open the Mr. Carlos Booser record on the data view as it does not pass the restriction enabled on the child tab of Phone type.