Custom permission always denying access?
The default function for the access callback is user_access(), which has the following signature:

function user_access($string, $account = NULL)


This is the function that will receive your access arguments.

It only takes one permission string at a time, so the second string you're passing in is being used as the $account object. This will cause problems in the user_access() function and is probably why it's returning FALSE all the time.

If you want to test two permissions you could provide your own access callback:

function mymodule_menu() {
  $items['reports'] = array(
    'title' =&gt; 'Reports',
    'page callback' =&gt; 'reports',
    'type' =&gt; MENU_CALLBACK,
    'access callback' =&gt; 'mymodule_reports_access'
  );
  return $items;
}

// Potentially accept an account object to make the function more re-usable
function mymodule_reports_access($account = NULL) {
  if (!$account) {
    global $user;
    $account = $user;
  }

  return user_access('access content', $account) &amp;&amp; user_access('hr functionality', $account);
}