If the group that has been defined in the per-repository constraint does not exist, the access is granted to anyone (who is logged in). The default behaviour should be to deny access from everyone.

This might have some connection with CWD-217, as those kind of exceptions will be filed in the error log.