groups/rw not working correctly?

We have many machines in our machine room, including machines which we
host for other departments.  Those departments should only be able to
access their own machines.  Our admin group should be able to access all
consoles.

My config looks something like this:

group finance {
  users abc123;
}

group hr {
  users xyz321;
}

group assisted_sysadmin {
  users finance;
  users hr;
}

group admin {
	users *;
	users !assisted_sysadmin;
}

default * {
	rw *;
}

console foo {
  rw finance, admin;
  ...
}

However, when I try this, finance and hr can't access their consoles.  
They get a permission denied error.  Is my config wrong or is this a 
bug?