Groups drive policy, SSO access and local-account mapping — derived from user membership.
Groups are derived from authoritative user memberships; add membership through a user workflow.