add group entity and dao
check permissions by group membership