to prevent the case there is no group then it can only match rules with null usergroup