Group REPLACES the config-managed group allow entries. Absent or null leaves them alone; an empty list clears them.
List<String> group;