ordering for credential groups