Vault operators can create two types of groups in Vault. What are the two types?

"User groups" is a generic term; in Vault, the specific types are internal and external.

External groups in Vault are typically managed by an external identity provider (like LDAP or Active Directory) and allow Vault to map these external groups to Vault policies, streamlining access control for users from external systems.

While groups are used to apply policies, "policy groups" is not a formal type of group in Vault; rather, policies are *applied* to internal or external groups.

Internal groups are created and managed directly within Vault, enabling operators to define collections of Vault entities and assign policies to these groups, which then apply to all member entities.

"Security groups" is a term often used in networking or cloud provider contexts (e.g., AWS Security Groups) and does not refer to a type of group within Vault's identity management system.