Describe the bug
We defined an application and added group bindings, the policy mode is set to all.
Bindings:

• group1, negate result
• group2

The settings fail on error and order have no impact on the outcome.

I would assume, that the user will only be allowed when not in group1 but in group2.
Currently the !group1 && group2 expression seems like actually evaluated as !group1 || group2, so the effect of switching between any (or concatenation) and all policy mode (and concatenation) has no effect.
The rules on their own (setting only one active) pass the test as expected.

Version and Deployment (please complete the following information):

• authentik version: 2025.8.4
• Deployment: docker-compose