The inconsistencies described below may occur in the domain of the attachment created from Attachment Creator SOAP webservice:

1. If the attachment size is bigger than the cut-off value set in the system property glide.soapprocessor.large_field_patch_max, it will save the SOAP message as an attachment into the sys_attachment table.
In this case, the attachment file's domain will be set as user's domain, as the BR "Domain - Set Domain - Attachment" will not be triggered.

2. If the attachment size is smaller than the value set in glide.soapprocessor.large_field_patch_max, it will save the payload into ecc_queue.payload first and then convert to an attachment.
This action is done by the business rule "AttachmentCreatorSensor" and the script include "SoapAttachments". In this case the Business Rule "Domain - Set Domain - Attachment" will set this attachment's domain to the incident's domain.

This is expected behaviour since Geneva, as using the Attachment Creator web service is no longer recommended. Use instead the REST Attachment API, which writes the attachment directly into the attachment table. This will cause the attachment to belong to the correct domain based on the user for all attachment sizes.

Ref.:

Geneva Attachment API

Kingston Attachment API