Row level security using if-clause

Hello,

I am trying to implement a RLS to limit the security. We are receiving the values to restrict on from a database directly, so in theory I only need to apply a simple RLS where I restrict on the user. However, the thing that makes it a bit more difficult is, that I need to restrict on two dimensions: Company and business area. A user can have access to all companies and all business areas, or access to only a few companies, but all business areas.

The main issue is, that if a user has access to all company codes or business areas, I only receive a star (*) as restriction, but no full list of all possible values. For example: 

In this example, user Chris should see all business areas, but only the company codes listed. The company code restriction is easy to achieve, as I can simply link the table to my company dimension and apply a bi-directional filter. But how can I handle the star (*) entries?

What I have tried is to create a dummy user in my security table that has all business areas and company codes assigned to it. Then I wanted to apply the following logic in a role:

If the table contains a star value, then apply a restriction on my dummy user, else apply a restriction on the current user.

The code would look like this:

[USER] =
IF(
IF(

CONTAINS(

CALCULATETABLE('Security business area','Security business area'[USER]=USERPRINCIPALNAME())

 ,'Security business area'[Restriction],"*")

,"YES","NO")="NO"

,USERPRINCIPALNAME(),"DUMMY")

If I test this formula in a normal measure, it works just as I expect it to work. However, if I use this formula in the role definition, it works for the users that have a restriction (meaning they don't have a star value), but it does not work for the users that have a star value (I don't even get the "DUMMY" as result).

Does anyone have any idea why, or has any different solution?