In the AGULP model, who should be assigned permissions and privileges?

Universal Groups aggregate Global groups across domains but are not the endpoint where permissions are assigned in the AGULP model.

AGULP defines a nesting strategy where user Accounts are placed into Global groups, Global groups are nested into Universal groups, Universal groups are nested into Local groups, and permissions are granted to Local groups. This separation allows flexible cross-domain membership while keeping permission assignments manageable at the local level.

Individual user accounts are added to Global groups in AGULP - assigning permissions directly to user accounts bypasses the model and creates an administrative burden.

Global Groups hold user accounts from a single domain and are nested upward into Universal or Local groups, not the target of permission assignments.