> I need to retrieve which resources a user can access for each group
can you elaborate on your use case? would it be sufficient to enumerate all of the resources that the user can access, or is it important that you're separating it out by the groups involved?