I am also experiencing this behaviour on JSS 9.99.0-t1494340586. My work
around is to clone and remove the ldap group from the limitation. Done
some test and found that this affected old policies only (policies
created in previous version). In effect...
