I have tables User, Roles, Groups and a join table GroupRoles. A user can have many Roles (some of which are not group specific), and a Group can have many roles. Since Role