GRP-1047: GrouperAll restrictions