- [ ] default permission groups are defined via templates (before hardcoded "administrator" in our code)