Q2 access rule error

Sometimes 'cannot translate identities' error when setting Access Rule.
Trying something else - see source code for details