Group permissions interface; some refactoring