On MODx Evolution, when hiding some resources from users via setting user groups and resource groups consider the following:
Some user roles (i.e. Editors) can run modules by default and with DocManager module they can add/remove groups from resources => they can get access to any resources.
"If you have nothing to say to your opponent then just look through his posts and find some spelling mistakes"