AGENT_ACCESS_GROUPS uses XML IDs (e.g. hr_expense.group_hr_expense_user) but the check compared them against res.groups.full_name strings which never matched, denying every user access to all restricted agents. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>