http://wiki.bestpractical.com/index.cgi?CreateGroupAndAddMembers
I have user that need to create RT groups and manage the members of those groups. By giving them AdminGroup right globally they can created groups. But to manage group membership they need AdminGroupMember globally, which is bad security because they could add themselves to groups with more rights. This overlay checks when a group is created and if the person who creates the group is a member of a Magic group, the Magic group is granted SeeGroup, AdminGroup (redundant but explicit), and AdminGroupMembership. Season to taste. -Todd