Isn't there also an exception for CUA in relation to position-based security? PRGN_CUST or similar to allow PFUD to update user masters for organisational structure inheritance and then "send" the assignment back to the CUA when CUA is a different system?
I can't remember the note but was asking for user's requirement in case something along these lines
When SMSY is being done by Basis, they get frustrated with CUA in place. Sometimes I'll let them break connection and then fix SCUG/SCUL afterwards for new system setup.
Regards
Colleen