fix: handling of allowed/forbidden groups in BaseBackend