[squid-users] ACL order of processing

Can someone lend a hand in on how ACLs are processed in squid?
I have my squid server up and running, but when I try and add in some
group membership validation, things start going wrong. It's almost
certain that I've the ACLs set incorrectly, as i'm not 100 percent on
how the rules are handled/processed by squid.

As you'll see from the cachelog, squid is refusing the GET command.
e.g "The request GET http://www.google.ie/ is DENIED, because it
matched 'all'" I can't figure out why this is happening.

I'm trying to set-up the rules for the following conditions:
* If a user is a member of the "allowedUsers" - they can use the proxy
provided the site url is not in my blockedurls list or the content
they are trying to download is not one of the restricted file
extensions.

* The second condition is an "unrestrictedUsers" group, which allows a
users (who is part of the group) to bypass all restrictions put in
place for the "allowedUsers"

many thanks,
Paul D.