permits object/user-group - frontendAccess + unit test (#4516 ieb)