Not sure how Schemes work

I'm confused by schemes.

I have two roles I need to restrict access for. One role is a basic approved user (not just authenticated), and the other is a sub-admin. I tried creating two schemes, since a scheme only allows choosing access type (view, update, delete) for all the roles in that scheme, instead of different access for different roles.

Anyway, Scheme 1 allows view access to the approved user role. Scheme 2 allows View and Update access to the sub-admin role. However, scheme 2 doesn't seem to be doing anything. I had to allow view in Scheme 1 to the sub-admin for them to be able to see the content at all.

What am I missing?

Thanks!