When a user's access to "Configuration Groups" and "Environments" is limited by adding a filter to his role, he can see them in some screens:

Configuration Groups
- Though not visible under "Configure" > "Configuration Groups", they are still visible when editting a host(group) under "Puppet Classes"
- Example: Assuming there are two configuration groups "allowed" & "forbidden", adding a filter to the role active for the user to limit access to "Configuration Groups" with "name = allowed" removes them from the above mentioned point "Configure" > "Configuration Groups", yet when editing a host(group) "forbidden" can still be seen, this even shows classes that are normally not visible to the user.

Environment
- Though not visible under "Configure" > "Environments", they are still show under "Configure" > "Puppet Classes"
- Example: Same assumption, two environments "allowed" & "forbidden" - they do not appear under the "Environments" menu, however, "Puppet Classes" shows "forbidden", when a class is in both environments.

Hope this was an understandable explanation.