Function validate_group_vec_access 

pub fn validate_group_vec_access(
    group_target_vec: &[String],
    group_available_vec: &[String],
) -> Result<(), Error>

Pure check that every label in group_target_vec appears in group_available_vec.

The async wrappers above resolve group_available_vec from the backend; this entry point exists for callers that already have the available list in hand (or for unit tests). On failure the BadRequest message lists the offending labels followed by the allowed set, so the user gets an actionable hint without a second round-trip.