basic group membership
use policy for group permission checks
coveralls test coverage