TARS: allowed user groups