[andix]

And matching Active Directory groups. It's kind of cool to use them, because it's a really easy way to let the users administrate access to resources without opening a support ticket.