When evaluating a user's access to a catalog item or knowledge article, the User Criteria Diagnostics tool the results do not match what the selected user actually experience when they are logged in or being impersonated.
One possible cause of this behavior is the use of the GlideUser API in a User Criteria script.
For example, a User Criteria script uses "gs.getUser().getCompany ID()" to retrieve the sys ID of the Company field from the sys_user record. This value may then be used in a GlideRecord query or in some other related context.
When a user evaluates another user's access to a catalog item or knowledge article to which this user criteria is applied using the User Criteria Diagnostics tool, the "gs.getUser().getCompany ID()" call will return the sys ID of the Company value for the current user, not the selected user. This is due to the fact that the tool does not use impersonation.
This is expected behavior as the User Criteria Diagnostics tool does not use impersonation. If you encounter this issue please submit an enhancement request to implement impersonation into the User Criteria Diagnostics tool.
As noted in the User Criteria migration documentation, there is a variable "user_id" which is available for User Criteria scripts which refers to the user being used in the user criteria.