You could have a list of allowed users AND a list of allowed groups and maybe some environments want to allow all users.