Formalize various access roles as objects

This centralizes the logic for group membership, and means that we
don't need to make queries to find out whether the legacy groups names exist.