return group grants on bucket/stream