Role groups will be part of the ACI system. It will let one create broad categories of permissions. Things like: helpdesk, user admin, group admin, whatever.