Using group membership for role-based access