add permissions to groups