The Java EE programming model defines the concepts of
Reals, Users, Groups and Roles
but many of the details are intentionally left outside the specification.
Shing Wai explains an
Extension of the Assign-Groups Property
that will be added to GF V2 M1
(to be released very soon!)
that addresses the common scenario where
permission is to be granted based on authentication independentely of identity.
Check Shing Wai's blog for details.