Okay this should do the trick, it also fixes some issues with the upcoming change logic for Granular group-based permissions for anonymous and logged in users :