Please check the following
a) If the business role is assigned to the user. Since the business role could be assigned only in three ways a) parameter in su01 b) org. level c) PFCG , therefore I suspect that b) / c) are not done hence when you do a) user is able to access the business role.
b) If the Z PFCG role is assigned to Z Business role.
Regards,
Kavindra