Infotype authorizations at Company Code level

Question

The project I am working on has two company codes 1000 & 1100.  The user requirement is that a person working in one company should be able to make changes only to employee data of employee's in his/her company and to have only read authorizations for employee data from the other company.
I've tried creating a role for Company 1000's employees where the authorization object P_ORGIN has Personnel Areas for that company code itself and all permissions (read, write etc.) and another role with read access to all Personnel Areas.  However, when assigned to a user, they are still able to access data from the other company (i.e. the company whose personnel areas were not listed in the first role). 
Any ideas what I am doing wrong and how I can resolve them?

Answer 1

Authorization level            *
Infotype                       *
Personnel Area                 1000's Personnel Areas
Employee Group                 *
Employee Subgroup              *
Subtype                        *
Organizational Key             *
Authorization level            R
Infotype                       *
Personnel Area                 1100's Personnel Areas
Employee Group                 *
Employee Subgroup              *
Subtype                        *
Organizational Key             *
This config should work.
Or can you post the values you entered in all the HR authorization objects in your role so that we can check. (P_ORGIN, PLOGI, P_PERNR etc)