A group has no layer: it may hold a platform role and an application’s role at the same time. Who is in one is platform business — otherwise an application’s administrators could walk themselves into whatever a group happens to hold. Groups do not nest, and the platform-admin superset is never handed to one.