I think you can simplify this inner block to just 1 line:

    raise '...' unless `groups #{@app.uid}` =~ /#{group}/