To be able to finetune access, it would be useful, that a user could be assigned not only to one, but to several (or even all) usergroups.
The rights should then be additive i.e.
- a user gets all rights of all the groups, he is assigned to
- if two (or more) rights compete each other, the higher right wins.