active and passive auth policy

Completely different objects.  "all" is an address object, Guest-group is a user object, and they use AND logic.  If source is <address> AND user is <user/group>, then match this.  Without a source address object there would be no traffic to match.  You of course don't have to use "all" but you must use some address object that catches the traffic you're after.