First, let me just say that I have combed through the forums and read the cACL instructions multiple times to no avail.
I am using Joomla v1.5.20 with the Rockettheme "Mission Control" admin template.
I have a group of users with the "Manager" Joomla permission assigned to them. I created a group & role for these users that only has K2 added to the "List of Allowed Components" with front/backend permission enabled. I do not have any content, menu, or other component permissions enabled for this group/role. The group/role is set to redirect to the K2 component page upon backend login. I set the access type to deny all by default in configuration. I have set cACL to run on the backend only, and have successfully synchronized its functions after configuring it.
After all of that, the backend redirect works but these users still have access to EVERYTHING and the ability to change ANYTHING that default Joomla managers have. These users are not restricted exclusively to the K2 component. They can see all of the default Joomla manager backend navigation items (menus, articles, users, and so on).
What am I doing wrong? I'm not getting any errors. I have followed the instructions to a tee but I have seen no solid example on how to specifically restrict a backend user to have access to only a single component.