Reset config does not seem to work when changing thing groups

I have the greengrass component C which its v1.0 is deployed to the thing group G1 and its v2.0 is deployed to G2. The deployment is done with the reset flag on both thing groups. I used to be able to move things around G1 and G2 depending on the version of C that I want each thing to have. It has been a couple of days when I do this, the config of component C gets messy. Here is an example: The recipe of C in v1.0 have the accessControl policy to aws.greengrass#PublishToIoTCore on dt/+ resource. The recipe of C in v2.0 have the accessControl policy to aws.greengrass#PublishToIoTCore on dt/+ and cmd/+ resources. I have deployed C (v1.0) to G1 and C (v2.0) to G2 with reset option. When I move thing T from G1 to G2, the version of C jumps to v2.0 but the accessControl policy does not include aws.greengrass#PublishToIoTCore on cmd/+. What am I doing wrong?

I can provide code, recipe and more error messages or information if needed.