You are using Control Rooms (not dashboards). Groups decide what rooms you can access. The UI only submits intent; the backend executes under policy and writes receipts.