- groups relation field on the user form, the only writer of users_groups - UsersGroup pivot model - AdminRelationLocks: adding or removing a group whose code is in golem15.user.privileged_groups needs golem15.users.manage_privileged_groups, on create and on update; refused saves answer 403 and write nothing - TestAdminUserGroupsField and TestAdminPrivilegedGroups