Issues with an experience that includes layers shared with different groups

[ChaimSchwartzIroads]

Our scenario: We want different users to be able to edit different layers. 

Technical background: We use Experience Builder Dev edition, v.1.12, ArcGIS Enterprise 10.9.1, and have prepared a number of editable layers (in the webmap) that are shared with different user groups. 

The issue: When a user opens the app, usually the first time the user only sees the layers they are privileged to view and also edit. However upon refreshing the browser tab, the user can see the other layers listed in the "layers" widget. This by itself is already a security issue. The data itself is not shown, but in the browser's developer mode one can see that there is an endless cycle of the app trying to fetch those other layers, resulting in thousands of browser requests every minute. 

[ChaimSchwartzIroads · Accepted solution]

Edit - see "edit" section below. 

I eventually figured out what the issue was: The editable feature service was shared the way I wanted it to be shared, but the respective map service was shared differently. This gap is something that can easily happen because (1) there is nothing to prevent you from doing so technically and (2) any time you change the sharing level, you have to remember to do it on both the feature and map service. However, I do know that officially this is not supported. 

Edit: Nope, that wasn't it. Turns out this has nothing to do with Experience builder - rather it is a more fundamental issue/behavior of the new map viewer: In the classical map viewer, if the map was shared with a certain user, and that user did not have the privileges to view a certain feature layer in that web map, this would result in an error - as expected. However, with the new map viewer, the viewer enters this endless cycle of trying to retrieve the layer - and failing. Note: when adding a layer as a "web service" (with the rest endpoint url of the feature/map service -  this doesn't happen. But there's some other issues with that...)