If the controlling node (host of the association group) do not have the highest S2 Security class of the controlled device (the one in the group), we should show a warning that such association will not work properly.
A device should ignore all control commands of S2 Security class lower that the higest one.
Also mention this on the dashboard of the EUI