Groups and grants

A role answers for a whole area. Groups and grants answer for something smaller: one bucket, one kind of bucket, or one row of data. A group is a named set of people, personas and tokens. A grant gives a group, or one of those on its own, a permission on a bucket, a bucket type or a row, and that is what Storage checks when something reaches for data. A privacy grant records who may see a private profile.