applicableGroup is now set before the permissions check, instead of after