LPS-46117 Use doAsGroupId since it is always set explicitly where we are coming from, and we need where we are coming from for staging
LPS-46117 Small refactoring
LPS-46117 escape as late as possible