...
This is in Grouper 2.4.0 UI patch #38
Add a policy group to a folder
You will see options with some selected by default
...
That creates this structure
Configure lockout groups and require groups
You can have lockout groups and require groups that users can use in policies even if they cannot READ them. Configure in grouper.properties
...