...
If the user
can attributeRead on group
can read on attribute definition
then they will see the settings in the group view "details" section
If the user
can attributeRead and attributeUpdate on group (and they need admin on group to edit the group)
can read and update on attributeDef
then they can edit the attributes in the group edit screen
...