Tag: which group scope is meant to be used to assign permissions to a local resource