implicit grant verifies required group membership