[api] basic permission checks for groups