[api] please brakeman
[api] basic permission checks for groups