Users with resource privilege should be able to create groups with resources they are allowed to see. Currently only users with global privilege can create groups.