Force the access rule to be "restricted" if the join rule is "public".