UserGroups with manually provided key/value pairs are now treated as "explicit" permissions, which will authorize add options if only that condition is met (vs current system, where add operations require all applicable filters to match, which causes issues with permissions on child objects without associated parent access)