A user group is an authentication identity of type core.user-group which can represent none, one or many users, i.e. authentication identities of type core.user or core.external-user. Document ACL records can contain user groups the same way as it would the other authentication identities. Like any other document is the system, user group document supports ACL. Adding or removing users to a group can be restricted using ACL.