we recommend the former IF you don't see the group...
# spicedb
j
we recommend the former IF you don't see the group needing to walk to other permissions on itself