is "what resources belong to which groups" also an authorization question?