Users can belong to Groups and Groups can belong to other Groups. For example, the Group Development can be set as a member of the Group Slough Office. In other words, the Group Slough Office is the Parent of the Group Development.
Users and Groups can be assigned a Role. For example, a Role can be created and named Administrator which is configured to Allow all privileges to members. There can be Users in several different Groups, each with the Role Administrator. Alternatively, there can be a Group which contains the Users who have all privileges and the Group can be a member of the Role Administrator.