Include showing:

• A user may have a role that allows them to administer a group of users without being a member of the group, but not all groups etc
• Groups may have subgroups, and members of those groups must inherit any privileges assigned to the parent group.
• associate custom information with an identity to store profile information (e.g. locale)