Implement access control methods on the group model.

We use a subset of the permission model to control groups.