Hi,
instead of having hardcoded constraints I suggest you to publish new attributes to use them as controlling switches, ex:
pcat.z_access (int)
cnt.z_access (int)
then use constraint like:
if ((category.z_access == 1) && ((group.z_access != 1) || (is_null(group.z_access))) {
} else if ((category.z_access == 2) && ((group.z_access != 2) || (is_null(group.z_access))) {
}
Regards.