CustomerGroupCustomer should exist as a nested toMany relationship inside Customer Group. There is no need for privileges on CustomerGroupCustomer. It should be set to "isNestedOnly" = true, which makes it effectively inherit privileges from CustomerGroup.