Access Control Behavior Changes Unexpectedly

[WORC]

Problem: I have a group of staff members that need to view a group of targeted contacts. Setting this up with ACLs works at first, but the list of targeted contacts appears empty for the staff group the next day.

My question: How is the permission for "Staff Group" to view members of "Targeted Contacts" get revoked by the passage of time or via some trigger I'm not considering?

Settings:

• In Drupal, the staff members' role is "authenticated users" with permission to "view my contacts" enabled.
• In CiviCRM Groups, they belong to the group "Staff Group" with access control enabled. There is also a group "Targeted Contacts" visible to "User and User Admin Only". These are static groups, not smart groups.
• In CiviCRM ACLs roles, the role "Staff Role" is assigned to "Staff Group". "Staff Role" is allowed to View those in the Group "Targeted Contacts".

Behavior:

• On day 1, a member of "Staff Group" is able to see everyone in "Targeted Contacts" by clicking "Contacts".
• On day 2, a member of "Staff Group" is unable to see anyone in "Targeted Contacts" by clicking "Contacts". However, on the "Manage Groups" page they are still able to see the group listed and an accurate count.
• At any time, a member of "Staff Group" is able to see everyone in "Staff Group" itself.

See update below.

The database is quite dormant and my two test accounts (admin/normal staff) are the only two actively in use. All I've been doing is creating groups, access control rules, and some phony contacts to test out hypotheses. The possibility I'm testing out right now is that my ACLs are interacting with each other but I don't see how--I'll post an update if that happens to be the case.

[WORC]

I started from scratch again but included more groups in my troubleshooting. As a result I think I can identify the problem more specifically: For each Role, only the most recently created rule is honored.

Example scenario:
Setup...
Create groups named Staff, G1, G2, and G3.
Populate Staff with 10 staff members
Populate G1 as a smart group that combines Staff, G2, and G3
Populate G2 with 1000 people
Populate G3 with 100 people
Test...
Create rule 1 saying Staff can view G1. Staff members see G1 having a count of 1110 contacts with 0 visible.
Create rule 2 saying Staff can view G2. Staff members see G1 having a count of 1110 contacts with 1000 visible, and G2 having a count of 1000 with 1000 visible.
Create rule 3 saying Staff can view G3. Staff members see G1 having a count of 1110 contacts with 100 visible, G2 having a count of 10000 with 0 visible, and G3 having a count of 100 with 100 visible.

Of course I can work around this by creating a buuuuunch of roles as I continue my installation but I'm hoping someone knows of a more elegant solution--possibly in the form of a logical error I'm making.