explain that whitelistread only works if group * doesn't have