I'd like to hide the 'Tools' navigation for only a single user group.

I created an overlay for /libs/cq/core/content/nav/tools under /apps/cq/core/content/nav/tools; then added a deny ACL for the navigation item like so: /apps/cq/core/content/nav/tools/rep:policy/deny. The reason for doing this is so that next time we upgrade our instance, the ACLs would remain.

When I log in as a user in the specific user group, I am still able to view the Tools menu. My assumption was that the overlaid items would take precedence over the content under /libs.

Any advice here?