Cisco AAA/Identity/Nac :: ACS (4.2) Read Only Device Access?

We are using ACS ver 4.2 and trying to setup users with limited access to our switchs and routers.  Here is what we did:
 
1) Created a user in ACS
 
2) Create Shell command Autorization Set - ReadOnly
Unmatched Commands - Deny
Commands Added
show
exit

* this should limit the user to the show and exit command only (correct)?
 
3) Created a group - HelpDesk with the following TACACS+ Settings

Shell (exec) is checked
Priviledge level is check with 15 as the assigned level
Assign a Shell Command Authorization Set for any network device - selected
ReadOnly - shell command autorization set seleted
 
When the user logs on to the router/switch it appears that he has full access.  He can enter the enable command, config terminal command, etc.  All we want him to be able to do is to issue the show command.