Given a dataverse that:

1. Contains unpublished Datasets
2. Has an explicit group with Admin role (call that eg)
3. eg has an IpGroup as a member (we'll call that ipg)

When a user logs in from an IP address that's a member of ipg, she does not see the card of the unpublished dataset. Note that when the role is assigned to ipg directly, these cards are shown.