External group user still sees media after restricting tag access

💻 Environment/Context

• User
• External group user
• Tag permissions
• Tag restrictions edited additionally on the user level
• AND OR rules 

❓ Issue/Question

• User I've adjusted tag permissions of still sees the media he's not supposed to

👌 Resolution/Answer

• Check if the user is part of an external group
• Go to Configure > Users
• Find the user and click Edit
• Change the rule next to their tag restrictions to AND

🥚 Cause

• When the platform checks the user tag access, it checks both the external group and user individual tag permissions. 
• If the external group has access to Tag A  OR  Tag B and the user level has a OR Tag A rule it will give access to all media that meet Tag A  OR  Tag B (ext group) OR Tag A (user level), which means the user would still have access to both Tag A and Tag B.
• If the access check runs through Tag A  OR  Tag B (ext group) AND Tag A (user level) it limits the ammount of media the user has access to, since now every media has to include Tag A.

🔖 Notes