Group membership and parent-of/child-of relations Access can be granted via direct access, or by being member of a group (that can be a child of another group) that has access to the resource.