Added ACL to Group domain object, and got it working.