Best practices on how to setup access control external identities

I have recently seen troublesome patterns for defining access control content for external identities (specially groups). the oak documentation should provide guidelines on how to do this.

cc: jhoh