Restricted group access does not work

we have two different drupal roles 'staff' and 'authenticated user'. we have a group "Restricted Access Contacts" in which we list all contacts that can only be accessed by 'staff' and not by 'authenticated user'. this feature does not work. i mean that authenticated user can access contacts in restricted access group.

i just upgraded to version 4.1.1 but on production site we are runing version 3.3.6 in which above does not function either. it must have stopped working after last upgrade.

note: we are running HRD module. i suppose this module was modifying the ACL as i cannot find this functionality in the general description of the way ACL should work.

please help. thank you.