managing users groups enforce permissions checks. User needs at least a read permissions on usergroup to be able to assign it somewhere.