UNIX groups could be handled by KeyCards, with the nice weird additional feature of User1 being able to let User2 into an area usually outside their permissions.

But really... idqd ... now bring on pid 1!