As an administrator, I want to be able to restrict apps based on the groups a user is member of. It should be possible to select more than one group; two or more groups are interpreted as "or", not "and".