Thanks for looking...
I defined security at IDT level only ! On top of the security defined universe, I built a WebI report with 3 columns. I want few users to see all 3 columns and for USER1 to see just 2 columns when they refresh the same WebI report.