You have a fairly complicated, branching group inheritance. For such cases, it's usually better to specify "can_target" in the positive. E.G., what groups CAN they target? Example, for admins, I'm assuming you want can_target set to "#admin,#trialmod,#moderator,#operator,#VIP,#user". The '#' ignores inheritance on group targeting ('%' includes inheritance).