Block file access + is not a member of a specific group doesn't seem to work

Describe the bug
essentially I have the block access set to block a tagged file as "Admin" to any one not in the "admin" group. But my admin user is also blocked, so seems like a bug

To Reproduce
Steps to reproduce the behavior:

1. Install the block file access Flow App
2. create a joint rule - file tag + group member is not a member of a group
3. Create a new file and tag it appropriately
4. As a user of an approved group (i.e. the 'is not member of said group) try to access the file.

Expected behavior
The user of the appropriate group should be able to access the file.

Screenshots
https://cloud.nextcloud.com/s/NTTrk56iKfPqeYN

Client details:
OS - Ubuntu 24.04
Docker install
Nextcloud 32.01
Collabora

Server details

Operating system:
Container - Debian
Web server:
Apache
Database:
MariaDB
PHP version:
8.3.27
Nextcloud version:

• 32.01

Version of the richdocuments app
9.0.2

Version of Collabora Online
version": "25.04.6.2

Configuration of the richdocuments app
No SSL - just http

Insert the output of ./occ config:list richdocuments (or equivalent adapted for your runtime environment)

www-data@ef1ca8dc1bd1:~/html$ php occ config:list richdocuments
{
    "apps": {
        "richdocuments": {
            "disable_certificate_verification": "yes",
            "doc_format": "ooxml",
            "enabled": "yes",
            "installed_version": "9.0.2",
            "public_wopi_url": "http:\/\/192.168.122.198:9980",
            "types": "filesystem,prevent_group_restriction",
            "wopi_url": "http:\/\/192.168.122.198:9980"
        }
    }
}



<details>
<summary>Logs</summary>

#### Nextcloud log (data/nextcloud.log)

Insert your Nextcloud log here

#### Browser log

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

</details>

Start by reproducing the reported Flow App rule with a tagged file and users inside and outside the specified group. Check the access decision path for the combined file-tag and group-membership conditions, then collect the missing Nextcloud and browser logs. Done means an approved group member can open the tagged file while other users remain blocked.