Document ACL and roles/groups

The conceptual difference between a role and a group is hard to grasp; We should make it clear in the documentation, by showcasing real use cases.