It seems that the preview rules option on the ACL control panel doesn’t include all the required rules.
Users not in any groups only show a single line - one assigned to "src":"*", nothing for the autogroup:members rule.
Users in groupA show the rules for * and autogroup:members, but not for groupA.
Machines tagged tag:monitor show the allow rules for group:groupA (which don’t include them) but nothing else, including the * entries.
The actual rules work as expected, as far as I can tell. The preview seems to pick a random selection of rules for any given user/tag and show them.
This isn’t new with the autogroup:members adddition either - I just swapped a "src":"*" for autogroup:members when it was introduced, but that entry in the ACL had the same problem before the swap
Is this just me?