fix blacklist logic by creating a 2nd group and putting org1 in it, giving that org access to all docs