rename / harden group access check.
make partition/group lookups less forgiving, and group access check more defensive.