If I'm understanding correctly, "audit" is a built-in labkey schema and "audit_db" is the same underlying database schema defined as an external schema. These will behave differently. The built-in schemas know how all the tables relate to each other... in particular, they enforce folder security through joins and foreign keys. External schemas are more primitive: if a table has a "container" column, it's filtered to the current container; if not, the entire table is visible -- they aren't able to trace foreign keys to locate the parent table that has the container column. This is what you're seeing and one reason we generally recommend not exposing the internal schemas.