fix some bug on allowed groups logic