diff --git a/front/lib/resources/group_resource.ts b/front/lib/resources/group_resource.ts
index f3824043827d..00b5b2f9b2b6 100644
--- a/front/lib/resources/group_resource.ts
+++ b/front/lib/resources/group_resource.ts
@@ -121,26 +121,16 @@ export class GroupResource extends BaseResource<GroupModel> {
   static async listWorkspaceGroupsFromKey(
     key: KeyResource
   ): Promise<GroupResource[]> {
-    let whereCondition: WhereOptions<GroupModel> = {
-      workspaceId: key.workspaceId,
-    };
-
-    // If the key is a system key, we also include the global group.
-    if (key.isSystem) {
-      whereCondition = {
-        ...whereCondition,
-        [Op.or]: [
-          { kind: { [Op.in]: ["system", "global"] } },
-          { id: key.groupId },
-        ],
-      };
-    } else {
-      // If it's not a system key, we only fetch the associated group.
-      whereCondition = {
-        ...whereCondition,
-        id: key.groupId,
-      };
-    }
+    const whereCondition: WhereOptions<GroupModel> = key.isSystem
+      ? // If the key is a system key, we include all groups in the workspace.
+        {
+          workspaceId: key.workspaceId,
+        }
+      : // If it's not a system key, we only fetch the associated group.
+        {
+          workspaceId: key.workspaceId,
+          id: key.groupId,
+        };
 
     const groups = await this.model.findAll({
       where: whereCondition,
diff --git a/front/pages/api/v1/w/[wId]/spaces/[spaceId]/data_sources/[dsId]/documents/[documentId]/index.ts b/front/pages/api/v1/w/[wId]/spaces/[spaceId]/data_sources/[dsId]/documents/[documentId]/index.ts
index 36f3f5ba9b30..f749f9d0655d 100644
--- a/front/pages/api/v1/w/[wId]/spaces/[spaceId]/data_sources/[dsId]/documents/[documentId]/index.ts
+++ b/front/pages/api/v1/w/[wId]/spaces/[spaceId]/data_sources/[dsId]/documents/[documentId]/index.ts
@@ -297,7 +297,7 @@ async function handler(
   if (
     !dataSource ||
     dataSource.space.sId !== spaceId ||
-    (!dataSource.canRead(auth) && !auth.isSystemKey())
+    !dataSource.canRead(auth)
   ) {
     return apiError(req, res, {
       status_code: 404,