Best way to restrict most HR Services to a set of groups. They should only access 4 HR services.

[geannaweed]

I have a requirement to restrict around 15 groups from accessing several other HR services but 4. They have the case writer role. What's the best way to do this. I don't see effectiveness on COE security policy as I have to identify all groups to attach to each COE so just this is implemented. Hope you can help me thanks.

[geannaweed]

This is quite difficult to implement as we may have more than 50 groups and using 90% of COEs which appears I would have to update  all of them on who and who cannot access the COEs/hr services. Need a shorter and more practical way to do this.