"denormalization between nested groups" sounds bit like an over-simplification. the paper does not mention how did they solved the "search with permission" problem. I wouldn't be surprised if Leopard also plays a role in that