Some improvements to product group permissions (see #721)