Are you sure it comes from dbc.allrights?
I don't think so.
When I create a new user, and then grant role to new user, I check from Rights held by DB/User, however, it's different result select * from dbc.allrights where username='new user';
Rights held by DB/User is more completely information.
I need to know where exactly come from, anyone can follow up?