What do you mean by "But when I log into the user" ?
Anyway, if you don't need particular sub-menu you can always delete it: use Tab Properties page.
I am using the latest version of public hosted Rollbase. I created a role called "Role test" and assigned it to one of my users. I edited the role so that my user can view menu "Products", but not the submenu item "DNS records" as you can see in the second picture of my first post. But when I log into that user I assigned "Role test" to, I can still view the submenu item.
It should also have been a "condition rule" on both the menus and submenus.
I will put this in the idea-section.