The Add User Group default is set to match ‘any’. When adding several groups, a user could easily forget to change this to ‘all’ and inadvertently authorize access to restricted content. I feel the default should be ‘all’ or ‘empty’ to force the user to make a decision. If not ‘empty’, at least set to ‘all’ presents a more difficult gate to pass through and the user is less likely to inadvertently reveal sensitive data by mistake.
1 Like