New 3.5 sc how to?

screenshots. 1st one shows how it is now, with provider and restrict not in global, i get a drop down of permission groups.

then i delete sec provider as it is setup globally.

now I dont get any permission groups to select