System groups: allow users to update systems via CLI