an iPlant use case
Administrators and power sers are allowed in the COmanage interface to create groups. This information is very specific to the VO, and not to any one institution. This information then becomes authoritative for other external sources, such as external storage vendors.