Users not part of HR group in COE ACL can see HR casesIssue The users who are NOT part of the group(s) configured in any of the HR COE ACL's are able to see the HR cases within particular COE.CauseGroup was added to COE ACL with child groups thus allowing permission.ResolutionThe users who had unexpected access to the COEs was found to be working as expected. The parent group 'HR' was added to the COE ACL, which provided permissions for users in all child groups of HR group. The product owners have confirmed this is working as expected. The specific users or groups who should have access to COEs should be added to the ACLs instead of the parent group.