A group that a user belongs to, identifying the source of a group-derived grant. Deliberately minimal: the access view only needs to name the group; full group detail (members, counts, status) is available through the group queries.