Camunda Human Task not blocking users from other group from claiming the task

I am constructing a PoC using camunda BPM running on Springboot. I am starting with a simple process and would like to efficiently use all the access rights restrictions such as candidate groups assignment. Here is my process:

Regardless of what the tasks does, I am trying to set the candidate groups for a human task so that users from other group cannot claim or see the task in their task list under the cockpit. They can even finish the whole process, even if they don't belong to any candidate groups configured, or not being the candidate user configured.

Does any one know if there are some configuration to be done, or how to properly enforce the allowed groups for a task execution and claim?

I assume you are using Camunda 7. You need to set the property

camunda.bpm.authorization.enabled = true

to enable authorizations. They are disabled by default.

https://docs.camunda.org/manual/7.17/user-guide/process-engine/authorization-service/

https://docs.camunda.org/manual/7.17/webapps/admin/authorization-management/