Permissions based on a group are not applied correctly