add precision about ACL groups intersection

docs/deploy-and-configure/configuration/access-conditions/index.md

@@ -57,6 +57,16 @@ PREFIX :        <https://vocab.eccenca.com/auth/Action/>
 
     Since both user and group resource are represented in the same namespace in the internal graph representation, users and groups cannot have the same identifier.
 
+!!! warning "All requirements in an access condition must be met"
+
+    Multiple **Requires group** values are combined with AND: the account must be a member of **every** listed group.
+
+    Combining **Requires account** and **Requires group** further restricts access.
+
+    To grant access to different audiences, create **one access condition per audience** or use [Dynamic Access Conditions](#dynamic-conditions).
+
+    For example, to grant access to members of either `group-a` **or** `group-b`, create two access conditions. Adding both groups to a single access condition would require the account to be a member of **both** groups.
+
 ### Define **what** grants are given
 
 - **Allow reading graph** is a list of graph IRI to allow to read these graphs.