We had previously used this for role mapping in our Jakarta Authorization implementation, without going too complex we need something similar within Elytron.

https://docs.oracle.com/javase/8/docs/api/java/security/acl/Group.html

We prefer immutable objects in Elytron so would suggest something very similar but without the add / remove methods.