you said "for a given user/group"