There is a possibility that SiteAccessProvider will return Site Accesses dynamically. This is why the Site Access group must be initially allowed to be empty.