Groups are used to represent groups of users, for example, groups of supplier users outside your organization. Groups can also be used to represent internal structures within your organization, such as purchasing groups or accounting departments. Groups should not be used to represent legal entities such as corporations, non-profits, or partnerships. To represent legal entities, you should use organization objects. For more information about groups and organizations, see the Ariba Buyer Data Load Guide.

You cannot assign a group to itself, and you cannot assign a role to itself, either directly or indirectly. Also, if a Group B is a subgroup of Group A, you cannot assign Group A as a subgroup of Group B, and likewise for roles.

For more information about groups, roles, and permissions, see the Ariba Buyer Data Load Guide.

The following way to assign groups, roles, and permissions to shared users is recommended:

• Create roles and assign permissions to the roles.
• Then create groups and assign roles to the groups.
• Then assign groups to shared users.

You can assign subgroups to groups, and you can assign subroles to roles, to create a hierarchy of groups and roles. Permissions are inherited between groups and subgroups and between roles and subroles in opposite directions:

• When you assign a subgroup to a group, the subgroup is indirectly assigned all the permissions of the parent group.
• When you assign a subrole to a role, the parent role is indirectly assigned all the permissions of the subrole.

A group also inherits permissions indirectly through roles assigned to the group; and a user inherits permissions indirectly through groups assigned to the user. For example, if Permission A is assigned to Role A, and Role A is assigned to Group A, then all the shared users who are members of Group A are indirectly assigned Permission A.

Roles do not inherit permissions indirectly from groups. For example, if Permission B is directly assigned to Group B, and Role B is also directly assigned to Group B, Role B is not indirectly assigned Permission B.