If you run a query 'SELECT * FROM MyProc' i.e. without a model/schema name, You'll receive the below error if an all Access Data Role is assigned to the VDB. If you remove the Data Role, the query succeeds.

Error: Remote org.teiid.api.exception.query.QueryValidatorException: User <user@teiid-security> is not entitled to action <READ> for 1 or more of the groups/elements/procedures.
SQLState: 50000
ErrorCode: 0

The query only succeeds if you fully qualify the proc/table when Data Roles are used.