Create admin groups that bypass all permissions; see #7