Most mistakes in this area come from treating one check as two, or two checks as one. A record has to be published and readable by the visitor; the two are independent, and administrators skip both, so test as a signed-out visitor or a test member, not as yourself. A check in a template hides content on one page; only a restriction on the record keeps it out of listings, other templates, the record's JSON and the API.
Read Two gates: published and permitted first: it explains the model, what a refused visitor sees, and where a check belongs. Restricting a record to a group is the procedure for access by role, with the test that proves it. Entitlements: access per record covers access that follows a purchase, a booking or an approval, where groups do not scale. Listings, search and the API is the check to run on a section before launch, and Members-only files explains why a restricted page does not protect the files it links, and what to do instead.