Make sure not to select "Never" on base groups. Consistent with XenForo permissions, if "Never" is chosen, it doesn't matter if the secondary group has "Yes", the user will still Never have permission.
Otherwise, I will need a more specific example that isn't working, because it is already designed to work as you have described.