An access-control group collects security principals so that a permission can be assigned to the collection rather than copied separately for every member. A file might grant read access to a laboratory group while withholding write access. Changing membership then changes who obtains the group's applicable permissions.
In Unix-style systems, process credentials include group identifiers, including supplementary groups, and file permission checks use the relevant identity information.[ref] The membership considered for an already running process need not change immediately when an account database is edited. Group names, account membership and the credentials used for a particular access check are therefore related but distinct pieces of state. Grouping users for permissions also does not imply that their processes are one scheduling job.
New to topics? Read the docs here!