Camunda user task with spring boot

Hi,
I have added a user task to group using camunda:candidateGroups=“XLOfficer” and then run the application. But I am able to complete the user task with any user for another group. The application is designed in Spring boot. As per my understanding if i add a user task to a group only user of that group should be able to complete the task. Please let me know if I am missing anything on configuration level as my application is role based.

Make sure that user is only part of that group

Yes I have created a new user and assigned to XLOfficer group but user from another group is also able to complete the task. Do we need to handle this with spring code?
<bpmn:userTask id=“TMSworkOrder” name=“TMSworkOrder” implementation="##unspecified" camunda:candidateGroups=“XLOfficer”>
bpmn:extensionElements
camunda:formData
<camunda:formField id=“WNO” label=“W No” type=“long”>
</camunda:formField>
<camunda:formField id=“TP” label=“Tech Provider” type=“string”>
</camunda:formField>
</camunda:formData>
</bpmn:extensionElements>
</bpmn:userTask>