another refactoring, treat group, permission, and usereav as a separate entities