An object's group may be changed at any time. In other words, everyone in the owner and group class, plus everyone else who presents a valid DES credential. Access rights granted to the world class apply to all authenticated principals. The nobody class is composed of anyone who is not properly authenticated. In other words, anyone who does not present a valid DES credential.
Groups contain individual entries and possibly other groups.
Tables contain both columns and individual entries. A given table will have one or more columns. A given group or table will have one or more entries. The four authorization classes apply at each level. Thus, a directory object will have its own owner and group.