Hi, in PRPC this technique is called SnapStart:

"SnapStart is a desktop HTML-based interfacing technique for capturing information from an existing system, accessed from a workstation, into a PRPC application."
It seems, that solution could be find out by using SnapStart technique to change available Application during login proccess.

Changing Application cause reload client web session and change user's current access group, in other words, for available pxRequestor.pxSecuritySnapshot.pxAvailableApps choose correct AccessGroup.pyAccessGroup.

Both tasks well done in SwitchApplication.jsp, main part of that is function:

<script>
         function switchApplication(accessGroup) {
  if(accessGroup == null) {
   accessGroup = document.getElementById('<pega:reference name="$this-Definition(pyPropertyName)"/>').value;
                                          }

  var oShowDesktopUrl = new SafeURL("Data-Portal.ShowDesktop");
        
                  var oRedirectUrl = new SafeURL("RedirectAndRun");
  oRedirectUrl.put("ThreadName","");
  oRedirectUrl.put("bPurgeTargetThread","true");

  oRedirectUrl.put("Location",oShowDesktopUrl.toQueryString());
  oRedirectUrl.put("AccessGroupName",accessGroup);
  window.location.href = oRedirectUrl.toURL();
         }
</script>

To build solution, lets try to write activity with java step or call Show-HTML method  for executing functionality of SwitchApplication.jsp on it.

After that, it will be possible to call this activity, pass its name as parameter, in SnapStart request URL.