Only the unit's SupplementaryGroups gave them, so 'sudo -u guard guard test' and 'guard check' could read neither /var/log's files nor the journal. systemd-sysusers (run on every install and upgrade) adds them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>