A group is a collection of identities or accounts used to simplify access assignment, communication or administration. Groups can grant access directly, be nested inside other groups or feed application roles and policies.
IGA governs group membership, ownership, purpose, nesting, requestability and review. Unowned or deeply nested groups can make effective access difficult to understand.