- maintainer for group can read, create, update, and admin cluster
- project user, at any level, cannot do anything with group cluster