Cross scope privilege

Hi guys, 

can someone please help me? I have a scoped application and on one table I have an application menu module ,,approvals,, which refers to Approval table in global scope sysapproval_approver. I need for fulfiller to be able to modify and read the approvals (only from scoped app) and for approval just to see it, not modify. I have set the ACLs, cross scope privileges and still if i impersonate the the users with that roles, it shows me the same error and allows me modify only something. I am really desperate and spend almost 5 hours trying to solve it. Please please help me somebody 😅😭