diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java
index 011174708a1..226a0f8fe05 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/GroupServiceBean.java
@@ -95,6 +95,7 @@ public Set<Group> groupsFor( RoleAssignee ra, DvObject dvo ) {
         while ( ! perimeter.isEmpty() ) {
             ExplicitGroup g = perimeter.iterator().next();
             perimeter.remove(g);
+            groups.add(g);
             
             Set<ExplicitGroup> discovered = explicitGroupProvider.groupsFor(g, dvo);
             discovered.removeAll(visited); // Ideally the conjunction is always empty, as we don't allow cycles.
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java
index 6a0be7d142d..e6435ef6431 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/groups/impl/explicit/ExplicitGroupServiceBean.java
@@ -117,7 +117,7 @@ public Set<ExplicitGroup> findAvailableFor( DvObject d ) {
     /**
      * Finds all the groups {@code ra} belongs to in the context of {@code o}. In effect,
      * collects all the groups {@code ra} belongs to and that are defined at {@code o}
-     * or one of its ancestors.
+     * or one of its ancestors. Does not take group containment into account.
      * 
      * @param ra The role assignee that belongs to the groups
      * @param o the DvObject that defines the context of the search.