This message was deleted.

I don't believe there is a cli command to bind/unbind authorization polices to aaa groups

I think there is

a little trick you can use it learn CLI if you don't know, then save your configuration and then make you changes in the GUI, after that go to system - diagnostics - saved vs running and it use it. But @Kari Ruissalo (WyW) is almost correct, it's

unbind aaa group NAME -policy NAMEOFPOL

I use the CLI all the time but when i checked the ns.conf i didnt see anything with bind aaa group name -policy so presumed it didnt exist