An identity group is a set of access control users who share the same permissions. Adding someone to the group grants that access; removing them takes it away. Groups keep a growing user list manageable, provided each group maps to a real need rather than to a job title that changes.
Every access control platform has some version of this idea, whether it is called a group, a role or a profile. The naming matters less than how closely the groups follow the building.
Groups, schedules and areas
A group usually combines areas and time schedules: dock staff between certain hours, cleaners overnight, managers at any time. The access decision comes from the union.
Keeping groups honest
Groups drift when they are duplicated for exceptions. Review membership on a schedule, and delete a group when its purpose ends rather than leaving empty permissions behind.