When creating e.g. a blog inside a group, there's nothing in the blog save action that would check whether the blog is using an access_id that is allowed to be used in the group.