Rights are assigned at the User and Group level. Access to resources is determined by those rights. Please be more specific in your questions - domain model (single\multiple) are you running Active Directory?...what are you trying to accomplish with these groups?