changed way permissions for groups are defined