What do you think about using an external solution for authorization? It's widely used and open source. We could enhance our tools with this and get rid of unnecessary group/role handling from our side.