What do you have for `sacctmgr list account`?  If "root" is your top-level (Slurm) (bank) account, AllowAccounts=root may just end up meaning any account.  To have AllowAccounts limit what users can submit, you'd need to name a lower-level Slurm (bank) account that only some users have an Association with.