2.1.2. Individual and Group Permissions
Who gets to do what
Once a visitor has logged in, access permissions can be granted based on what is appropriate for that user. But beyond the first couple users, specifying permissions grows complicated very quickly. User groups, or simply groups, ease this greatly.
Any number of groups can be defined, and appropriate permissions can be granted to each one. Then, each user can be added to one or more groups. This allows every user to have the sum of privileges granted by all the user's group memberships.
User groups are the best way to grant privileges
A user receives all the privileges given to all the groups to which he/she belongs.
Because there are typically many users, and users change more frequently, groups are a much simpler and safer way to grant permissions.