managing users groups enforce permissions checks.
User needs at least a read permissions on usergroup to be able
to assign it somewhere.