Command Groups in Permissions act as a filter and not as a combination
It's not clear from the configuration screen but using Command Groups in User and Role permissions doesn't pull in all the command from that group but instead only permits the individual command listed if they are in one of the groups given. This allows for the same named, but differently defined, command to be shown to different users or roles.
As an example, if you have two groups of commands, one called "Admin Commands" and the other "User Commands" and then place a "Show Log" command in each, but the commands select different log files.
So, same command defined in two groups:
The "Admin" user's Command Permissions:
The User user's Command Permissions: