This is something I cannot get my fingers on. If you generate a full security model all seem to work. But as soon as you fiddle with settings in the preferences things are starting to go wrong. This is a problem if you add new applications and need to sync. At one time I added a user, gave him system privileges and I could not get it to work. I synchronized things and it still didn’t work. Finally I destroyed my tables and regenerated all and it worked again. Problem was that my modifications where lost of course.
Another issue is that if you remove an application this will not be synchronized. That said, there needs to be additional functionality to the generated module. Beside synchronisation there needs to be a maintain module. Easy to create by yourself of course, but I think it should be default.
Final issue is that the module is showing the technical names of the applications. I recommend to add the description. Developers can live with this, but end-users must maintain the security list and need more info than the form_blahblahblah